Why LLM Security Needs Architecture, Not Just Prompt Instructions

A software experiment building an LLM-powered customer support agent highlights a critical security flaw: relying solely on prompt instructions to restrict data access is unreliable, since language models treat all input—including injected malicious text—as undifferentiated tokens. The developer argues that prompt-based rules are effectively suggestions, vulnerable to prompt injection attacks where malicious content in documents or user messages overrides intended restrictions. The proposed solution is architectural: scoped tools that accept authenticated session objects rather than raw parameters, making cross-customer data access structurally impossible rather than merely discouraged. In the demonstrated codebase, a customer's session ID is bound at login and cannot be altered through any chat input, ensuring the agent can only retrieve data belonging to the authenticated user. Unit tests confirm that even when a target record exists, requests from unauthorized sessions return empty results, leaking no information about the data's existence.