Keeping retrieved data structurally separate from instructions in the assembled context, and flagging anomalous embedded instructions before they reach the LLM.
Structural channel separation at the pipeline level, plus a lightweight classifier or heuristic pass over retrieved free-text fields for instruction-like patterns.
Prompt-injection detection libraries as a supplementary layer; the channel-separation architecture itself is not off-the-shelf