Keeping retrieved data structurally distinct from instructions in the assembled context, so a model cannot mistake content it retrieved for something it was told to do.
The architectural defense against a confused-deputy attack; a prompt-level instruction alone ('treat this as data') is not the same thing and does not reliably work.