Restrict What Can Act: Action Selector, Plan Then Execute, Context Minimization

"Once an LLM agent has ingested untrusted input, it must be constrained so that it is impossible for that input to trigger any consequential actions."

That sentence is the guiding principle of the paper "Design Patterns for Securing LLM Agents against Prompt Injections". A consequential action, in the paper's words, is one with negative side effects on the system or its environment. The sentence does not ask the model to recognize an attack, and it accepts that the model may read one. It asks you to arrange the system so that reading an attack does not matter.