PRODUCTION SCENARIO
An HR assistant answers employees' PTO-balance questions by calling the HR platform. The integration uses the platform's admin service account, which can also edit salaries and terminate records. During a red-team test an injected message got the assistant to attempt a salary edit that the system prompt forbids.
Which control most limits the damage from a successful injection?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Replace the admin credential with a token scoped to the read-only PTO endpoints
Least privilege is what bounds the blast radius: scoping the credential to the read-only PTO endpoints means a successful injection cannot reach the salary endpoint at all, whatever the model is persuaded to attempt. A longer list of forbidden actions sits inside the system prompt the injection already overrode. An output classifier guards the reply, while the damage is an API call that changes the record whether or not the reply mentions it. A log shortens recovery after the salary has changed.