How do you protect an app where the LLM can call tools from prompt injection?

Assume it will happen: any text the model reads (web pages, e-mails, documents, tool results) can carry instructions.
Give the model the least privilege: few narrow tools, scoped credentials, read-only where possible.
Validate every tool call in code (arguments, ranges, allowed targets) instead of trusting the model.
Separate reading untrusted content from taking actions with side effects, and avoid combining private data, untrusted input and an outbound channel in one agent.
Ask a person to confirm sensitive actions such as payments, deletions and sending messages.
Filter or block risky outputs, log all calls, and test with an injection set as part of your evals.