Topic starter
22/06/2026 4:59 pm
TL;DR: Prompt injection cannot be fully mitigated by better prompts because current LLMs cannot reliably separate instruction from data, so consequential authority must move behind cryptographic authorization boundaries, according to Scramble ID. Scope-per-tool tokens, step-up approval, dual control, and chain-aware delegation make harmful actions fail at the resource boundary instead of in the model.
Editorial analysis by NHI Mgmt Group, based on content published by Scramble ID: “Prompt Injection Defense Through Identity Controls: Why Authorization Boundaries Beat Better Prompts”.
Key questions
Q: What breaks when prompt injection protections rely only on prompt engineering?
A: Prompt engineering alone breaks down because malicious input is still processed as part of the same text stream as legitimate instructions.
Q: Why do scope-per-tool tokens reduce prompt injection risk?
A: They reduce risk because the model can only request actions already encoded in the token.
Q: How do teams know when step-up approval is enough and dual control is required?
A: Use step-up approval for moderate-risk actions where a single reviewer can reasonably assess the request, such as sending an external message or updating a customer record.
Practitioner guidance
- Map tool scopes to individual agent capabilities Give each agent tool a distinct authorization scope so summarization, search, email, deletion, and export are separately constrained.
- Enforce resource-boundary checks on every consequential call Validate scope at the MCP server or resource server before execution, not inside the prompt.
- Apply dual control to irreversible actions Require a second authorized approver for mass deletes, external payments, public posts, security policy changes, and large data exports.
Bottom line: Prompt injection becomes materially dangerous when the model itself can trigger consequential actions, because the security boundary sits in the wrong place.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 5:11 pm
Prompt injection is really an authorization problem disguised as a language problem. If the model can be manipulated, then any security control that depends on the model staying loyal has already failed at the wrong layer. The decisive question is not how well the prompt resists manipulation, but where the system refuses to act even when manipulation succeeds. That makes cryptographic authorization boundaries the structural control point.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between human-in-the-loop approval and dual control for AI agents?
A: Human-in-the-loop means a human reviews or authorizes an action before it proceeds. Dual control is stricter because it requires two authorized humans to complete a cryptographic approval for a high-impact action. In practice, HITL is for reviewable risk, while dual control is for actions where segregation of duties matters.
👉 Read our full editorial: Identity controls are the structural defence against prompt injection