 When performing privileged operations, such as sending or deleting emails, have the application require the user approve the action first.  This will mitigate the opportunity for an indirect prompt injection to perform actions on behalf of the user without their knowledge or consent Segregate external content from user prompts.  Separate and denote where untrusted content is being used to limit their influence on user prompts.  For example, use ChatML for OpenAI API calls to indicate to the LLM the source of prompt input Establish trust boundaries between the LLM, external sources, and extensible functionality (e. g