How are prompt injection and untrusted tool inputs contained?

“Treat webpages, documents, emails and tool responses as untrusted data rather than instructions. The agent should receive task-specific context, approved tool schemas, server-side authorization, output validation and confirmation gates for irreversible or high-impact actions.”