Asked about Defending architecturally
Your agent reads customer emails and can issue refunds. What is the risk and what do you do?
An answer that works
An email can contain instructions the agent follows, so refunds become attacker-controllable. Split it: an extractor with no tools reads the email and emits structured fields; a separate actor issues refunds from those fields only, with approval required above a threshold and full audit logging.
Then they push further
The business wants refunds fully automated. How do you make that work?
Automate the low-risk band: refunds under a small amount on orders that exist and belong to the sender, checked in code against the order system rather than trusting what the email says. Everything else goes to a person. Measure how much volume falls in the automated band.
What gets marked up
Marked up for checking facts against the system of record rather than the email, and for proposing a risk threshold instead of all or nothing.
Reading an answer is not being able to give one. The section that teaches this is Defending architecturally, 3 hours of Prompt injection & guardrails.
Learn this properly