Prompt injection is an authority problem, not a wording problem

Most prompt injection defences are a sentence in a system prompt, which asks the thing being attacked to defend itself. The alternative is architectural: the model never holds authority, and every tool call is re-checked against the user's own permissions.