An agent triages inbound customer emails, summarizes them, and has tools to look up orders, issue store credit, and forward emails to external addresses. Security shows that an email containing hidden instructions can make the agent forward the conversation history to an attacker's address. Which two changes most effectively reduce this risk? Select two.

Answer: A and C — Split the design so the step that reads raw email has no action tools and returns validated structured fields to an acting step / Remove the external-forwarding capability, or restrict its destinations to an allowlist of internal addresses enforced in code

Indirect injection is contained by limiting what a hijacked model can do. Privilege separation (a) keeps untrusted text away from the step that holds powerful tools, and removing or allowlisting the egress channel (c) closes the exfiltration path in code. (b) is worthwhile mitigation but stays probabilistic. (d) may reduce susceptibility somewhat, but it doesn't remove the capability an attacker is exploiting.