1
Inventory every untrusted input
Start with a concrete list of the places your application accepts or generates text. Include direct user
messages, uploaded files, OCR output, retrieved documents, search results, connector responses, tool results,
and saved conversation state. If it can eventually be merged into model context, it belongs in the inventory.
2
Mark what reaches model context
For each item in the inventory, answer one question: does this text reach the model as prompt content, retrieved
context, tool context, or conversation history. If the answer is yes, it is part of the prompt-injection surface even
if the original source was not a chat box.
3
Separate the boundaries you actually control
Most teams think only about user input. In practice, there are at least four boundaries worth checking: the inbound
request before the model call, the context-ingestion step before retrieved or third-party text is merged, the
execution boundary before model-generated tool actions are trusted, and the output boundary before model output
reaches a user or another system.
4
Put Anthale before the boundary, not after it
Run Anthale before untrusted material crosses into the next stage. That means before prompt assembly, before retrieved
context is appended, before high-risk tool output is trusted, and before sensitive output is delivered. If you wait
until after the model has already consumed malicious context, you are no longer preventing prompt injection. You are
only observing the aftermath.
5
Review the surfaces people forget
The surfaces teams miss most often are long conversation history, retrieved snippets from trusted-looking
sources, tool results that are fed back into the model, and text extracted from files or images. Those paths
often feel indirect, but they are exactly where prompt injection becomes hard to notice.
Result
At the end of this exercise, you should have a boundary map that tells you where Anthale runs on theinput path, where your application still needs business authorization, and which indirect sources deserve the same level of scrutiny as direct user input.