How would you defend against indirect prompt injection?

I model information flow explicitly: which untrusted source influenced which model step, which sensitive source was simultaneously available, and which external sink could receive output. High-risk combinations are prevented structurally, sometimes by using separate model calls or execution zones that never share both secrets and egress authority. Security tests include hidden text, quoted chains, attachments, multimodal content, encoded instructions, poisoned memory, and malicious tool output. Monitoring looks for abnormal tool sequences and exfiltration patterns while preserving a usable false-positive rate.