You can't fully stop prompt injection. Here's the layered defense we built instead.