A system-level approach to prompt injection: separating instruction and data channels in LLM agents [P]

Prompt injection has emerged as one of the most persistent failure modes in tool-using LLM systems, particularly in agentic workflows where models interact with external data sources.

Most mitigation strategies focus on input filtering or model-side alignment, but these approaches struggle because the core issue is structural:

Approach

I explored a system-level mitigation strategy by introducing a middleware layer (Sentinel Gateway) that enforces a strict separation between:

- Instruction channel: trusted, runtime-issued commands

- Data channel: untrusted external inputs (web, files, APIs)

Instead of attempting to classify malicious inputs, the system ensures that:

All agent actions require a signed, scoped runtime authorization token, effectively decoupling observation from execution.

Implementation

- FastAPI middleware layer for agent tool calls

- Token-based authorization for execution requests

- Streamlit interface for inspection and debugging

- Audit logging of agent decisions and tool usage

- Supports multi-agent integration patterns (e.g., Claude-based sessions)

- Local or Postgres-backed persistence layer

Repo

https://github.com/cmtopbas/Sentinel-Gateway

Discussion question

I’m interested in feedback on:

- whether instruction/data separation is a meaningful abstraction for agent safety

- failure modes in token-based execution gating

- how this compares conceptually to other agent safety or sandboxing approaches