Prompt Injection — Part 2: Defense Architecture, Controls & Policy Templates — 42 Templates, Checklists & Worksheets for Privilege Separation, Spotlighting, Guard Models, Gates, Detection & Residual Risk

No defense makes a language model un-foolable — so this pack builds the system that survives being fooled. 42 production templates, checklists & worksheets distilled from Chapters 7–12 of Prompt Injection: The Complete Defense Guide (plus its Master Defense Checklist, Policy Templates, and Control Quick Reference appendices): privilege-separation zones with schema-bound cargo, structured scaffolds and spotlighting, the dual-LLM split and guard checkpoints, consequence-tiered gates with the book's twelve-tool tiering table, canaries and the regression-suite program with its honest ASR number, the signed residual-risk statement — and the book's two policy templates in full. PDF + Markdown source.

Assume the model will be fooled. Build so it doesn't matter.

Every defense that tries to keep a language model from being persuaded eventually meets the payload it didn't imagine. Prompt Injection — Part 2 is the defense-architecture half of the dedicated injection book: 42 copy-paste templates, checklists, and worksheets distilled from Chapters 7–12 — architect privilege separation so the component that reads untrusted text holds no authority worth stealing, parameterize the prompt so data is marked as data, compose a second mind on watch whose failures don't correlate with the first, build the deterministic perimeter of gates, sandboxes, and output control, operate the whole stack as a measurement with canaries and a regression suite, and govern what remains as a signed residual-risk statement instead of a hope. It closes with the book's own closing tools: the complete 44-line Master Defense Checklist, both Policy Templates in full, and the sixteen-control Quick Reference on one page.

Every item carries the book's tested positions built in: zones defined by authority rather than servers, with cargo rules a schema enforces — facts and provenance-tagged claims cross, raw text, credentials, and imperatives never do; delimiters with per-request nonces and integrity checks, and datamarking applied mechanically by the assembler, with the published spotlighting results the book reports labeled as the book's report, task- and model-dependent; a dual-LLM split in which labeled claims cannot command, four guard checkpoints with verdict actions decided in writing in advance, and decorrelation by vantage, machinery, and information; gates tiered by consequence — free, gated, forbidden — with provenance rendered first, a short leadership-owned forbidden list, deny-by-default for everything new, and break-glass paths that are loud, narrow, and expiring; a telemetry record specified for the post-mortem you will actually hold, detection at four altitudes, and a suite discipline that reports silent success rate separately because that is the number that predicts incidents; and a residual-risk statement signed by the business owner who carries the risk — never by the team that measured it. Where the book gives an example — its rebuilt email assistant, its research agent reviewed twice under two designs, its twelve-tool tiering table, its fictional residual-risk specimen — the template labels it as the book's example for you to refill with your own measurements; the specimen's own instruction is carried with it: copy its shape, not its numbers. Bracketed fields are yours to fill; nothing here invents a statistic for your system. And the book's honesty rule governs the whole pack: there is no foolproof prevention of prompt injection, and nothing here promises immunity — every layer is a measured reduction, and the last sections price what remains.

What's inside — 42 templates, checklists & worksheets in 7 sections

1. Privilege Separation — Architecting Systems That Assume the Model Will Be Fooled (6) — Zone Model Design Sheet · Boundary Cargo Rules Sheet · Three Shapes, Sizing & Managed-Services Map · Worked Rebuild — The Email Assistant, Zone by Zone · Migration Plan — Getting There From the Monolith You Have · Patterns, Anti-Patterns, Boundary Tests & Batch Rules

2. Parameterize the Prompt — Structured Queries, Delimiters, and Spotlighting (6) — Scaffold & Typed-Slot Specification · Delimiter & Spotlighting Implementation Sheet · Scaffold Writing Craft Sheet · Before/After Prompt Rebuild Worksheet · Assembler Implementation Checklist · Structure Measurement & Scaffold Review Agenda

3. The Dual-LLM Pattern & Guard Models — A Second Mind on Watch (6) — Dual-LLM Split Design Sheet · Guard Checkpoint Specification — Four Insertion Points · Decorrelation & Guard-Tuning Discipline Sheet · Worked Example — The Research Agent, Reviewed Twice · Checker Composition Sheet — Cascades, Votes & the Judge Problem · Reader Schema Design Contract & Failure Gallery

4. Gates, Sandboxes & Output Control — The Layers That Hold When the Model Doesn't (7) — Consequence Tiering & Gate-Design Sheet · Sandbox & Harness Specification · Toolbelt Tiering Worksheet — Twelve Tools Tiered by Consequence · Output Control & Egress Inventory Sheet · Forbidden List & Deny-by-Default / Break-Glass Rules · Human Factors, Perimeter Metrics & Paper Trail Sheet · Seven-Layer Stack Map

5. Detection, Telemetry & the Test Suite That Learns From Every Escape (6) — Telemetry Record Specification · Canary & Tripwire Deployment Sheet · Detection at Four Altitudes & the Review Queue · Regression Suite Build Sheet — Cases, Grading, Gates · Metrics & Quarterly Report Skeleton · Operate-Layer Program Plan — Roles, Cadence, and the First Ninety Days

6. Living With Residual Risk — Incidents, Case Patterns & the Conversation With Leadership (5) — Injection Incident First-Hours Playbook · Six Case Patterns Review Worksheet · Residual-Risk Statement Template · Tabletop & Drill Kit + the Monday Sequence · Standing Program, Governance Loop, Team & Ethics Sheet

7. Master Checklist, Policy Templates & Quick Reference — The Book's Own Closing Tools (6) — Master Defense Checklist I — Inventory, Ingest, Prompt, Architecture & Actions (29 lines) · Master Defense Checklist II — Output, Sessions & Operate (15 lines) · Policy Template — Acceptable Use of AI Assistants (Staff-Facing) · Policy Template — Prompt Injection Response Policy (Security-Facing) · Control Quick Reference — Sixteen Controls on One Page · Rules of Thumb & Part 2 Defense Gate — Chapters 7–12 Sign-Off (the book's six chapter checklists consolidated into one evidence-backed gate, 31 lines, plus Appendix D's eight rules of thumb)

Who this is for

AI platform and application-security engineers designing or reviewing LLM applications that read untrusted content or act on the world, architects drawing the boundary between a model and its tools, and security leads who need a defense they can measure and a residual-risk conversation leadership can sign. The source book assumes familiarity with ordinary web-application security — input validation, least privilege, incident handling — and this pack is complete on its own: if your flagship application's "model fully fooled" scenario still ends in a breach notification rather than a bad day, start at Template 1.

What this pack is not

Not Part 1. The attack patterns, the mechanism chapters, and the Injection Test-Case Catalog are the book's Chapters 1–6 and Appendix B. They live in the Part 1 companion pack; nothing here restates them, and this pack is complete and useful without them. Where Chapters 7–12 point back to that catalog — the suite's seed source, a fatigue drill — this pack carries the pointer only, exactly as the chapters print it.

Not immunity, and not complete prevention. The book's own position, carried in full: prompt injection has no foolproof prevention; persuasion resistance is a probability. These templates separate, structure, gate, detect, and govern — they reduce what a successful persuasion can reach and they measure the residue. Any pack that promises to make a system injection-proof is selling the claim this book exists to refute.

Not the general security program. The companion AI Security in Production — Part 1 pack covers injection as one section of general AI security, from its own book. This pack is the dedicated injection book's defense architecture in depth — zones, spotlighting, dual-LLM composition, the suite program. The two packs share no item, taxonomy, or worked example.

Not agent-identity or registry artifacts. The companion Securing AI Agents packs build agent identity, permission matrices, and the agent estate's operational controls from the agent book. This pack designs the injection-specific perimeter around any LLM application — chatbot, copilot, or agent — and ships no registry or identity artifact.

Not the cross-book security slice. The companion AI Security Templates & Checklists pack holds the MCP-and-enterprise-agents artifacts. Territories adjoin — it carries an approval-gate form in the MCP frame; this pack carries the injection book's full consequence-tiering gate system with its forbidden list, break-glass discipline, and perimeter metrics — and no item, title, or wording is shared.

Not legal advice. Appendix C's two policy templates are the book's adaptable drafts — "adapt, not adopt blindly," in the book's words, with bracketed decisions left to your organization. Nothing here certifies compliance with any regulation or standard.

Companion products

Prompt Injection — Part 1: Attack Patterns & the Test-Case Catalog is this pack's sibling, built from Chapters 1–6 of the same book plus Appendix B: a companion for the attack-pattern and testing half of the discipline — never a requirement for this pack to work. The AI Security Templates & Checklists pack is the cross-book security companion. AI Security in Production — Part 1 is the general-AI-security companion, from the sister book. Securing AI Agents — Part 1 is the agent-foundation companion. This pack stands alone.

Note: the $99 Architecture Templates Bundle currently contains Products #1–#3 only. This pack launches standalone; no bundle inclusion is promised for this product.

Built by the author of Prompt Injection: The Complete Defense Guide, from the defense-architecture discipline behind production enterprise AI systems.

About the author

Naveen Kumar Josyula is the author of 35 AI books on Amazon KDP and the CEO and founder of AISoltrics Technologies Inc. He is the author of the source book, Prompt Injection: The Complete Defense Guide, from which every template in this pack is distilled.

Support promise

If anything in this file is wrong or unclear, email support@aisoltrics.com before you judge it — we fix verified issues within one business day and send you the corrected file free. (You can also reach the founder's office at aadhya@aisoltrics.com.) Updates to this product are free to past buyers via your Payhip library. Sold by AISoltrics Technologies Inc.