PRODUCTION SCENARIO
An HR assistant answers employees' PTO-balance questions by calling the HR platform. The integration uses the platform's admin service account, which can also edit salaries and terminate records. During a red-team test an injected message got the assistant to attempt a salary edit that the system prompt forbids.
Which control most limits the damage from a successful injection?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Replace the admin credential with a token scoped to read-only PTO endpoints
Least privilege is what bounds the blast radius: scope permissions as narrowly as possible and run tools in sandboxed environments so a successful injection cannot reach the salary endpoint at all. A prompt rule and an output filter both sit inside the path the injection is already subverting, and a log only helps after the salary has changed.