Prompt injection in AI agents is best stopped by architecture: separate reading from acting, allowlist tools and exits, and ...