Do not claim you prevent prompt injection. Say you assume it can happen and limit the damage: narrow tool permissions, approval for risky actions, separation of untrusted content from instructions, and monitoring. A reviewer trusts a layered answer more than a promise of a filter that blocks everything.
Define the term for the reader
Prompt injection means text the model reads, such as a web page, a ticket or a document, contains instructions that change what the model does. The OWASP project for large language model applications lists it among the main risks for these systems. Because the model treats instructions and data as one stream, you cannot fully separate them by wording alone.
That is why the honest answer focuses on consequences. If an injected instruction cannot do anything harmful, it matters much less.
Layers to describe
- Least privilege. The agent holds only the permissions the task needs. The MCP security guidance on scope minimization warns that broad tokens, such as wildcard or admin scopes, raise the impact when a token is compromised.
- Approval for impactful actions. Writes, deletes and external sends need a human decision, with the real tool input shown.
- Untrusted input handling. Content from outside the company is labelled as untrusted and is not allowed to trigger actions on its own.
- Output checks. Results from tools are validated before they go back to the model, which the tools specification suggests for clients.
- Monitoring. Unusual tool call patterns are logged and reviewed.
What to avoid saying
- "We use a prompt injection filter, so we are protected." Filters help but can be bypassed.
- "Our system prompt forbids it." Instructions in a prompt are not an enforcement mechanism.
- "It has not happened to us." Absence of evidence is not a control, and it invites the question of how you would know.
A reviewer friendly structure
| Question | Strong answer shape |
|---|---|
| Can untrusted content reach the model? | Yes, from these sources, handled as untrusted |
| What can an injected instruction do? | Limited to these tools and scopes |
| What needs approval? | These action classes |
| How would you notice? | Logs and alerts on these patterns |
| How do you test? | Named exercises, with dates |
Testing deserves its own line. Even a small exercise, where someone plants an instruction in a test document and checks what the agent does, gives you real evidence. See how to test that your AI assistant controls actually work.
Sample wording
"We treat all external content as untrusted. Agents run with narrow scopes, destructive or external actions need human approval, and tool calls are logged. We run injection exercises against our agents and record the results. We do not claim that injection can be fully prevented."
That final sentence usually earns credibility, not suspicion.
Evidence
Test notes with dates, the permission matrix for agents and a sample alert. Safeguard offers an MCP Guardrail for governing agent tool calls and agent identity so each agent has its own scoped identity.
Quick check
Is prompt injection the same as jailbreaking?
No. Jailbreaking is a user trying to push a model past its rules. Injection comes from content the model reads, often without the user noticing.
Can we say we are compliant with the OWASP list?
No. It is a list of risks, not a certification. Say which risks you have assessed and what you did about each.
Sources
- MCP security best practices
- MCP tools specification
- OWASP Top 10 for Large Language Model Applications
Last reviewed: 19 October 2026.
