Prompt injection defenses fall into two categories: probabilistic and structural.
Probabilistic: better system prompts, output filters, RLHF. These reduce attack success rate but cannot eliminate it.
Structural: data tainting, policy enforcement at the middleware layer, least-agency by architecture. Microsoft FIDES implements the structural approach. Open-source. Deterministic.
Worth understanding even if you do not adopt it directly — it defines the bar.