You're designing an email assistant that reads, summarises and forwards mail. Which defences do you put in, and where?

First label every part of the context by who controls it: an email arrives through my code, but a stranger wrote it. Instruction-hierarchy training and delimiting untrusted text only lower the odds.

So block where the damage happens, in code: least privilege, user confirmation on every forward, and an output check for links. In the lesson's planner, its own mapping rather than a measurement, 24 of the 64 combinations stop both attacks.