Nicely done. This isn't a criticism, but i wonder if a well designed system needs prompt injection guards at all. Provided all security happens outside of the models and models only have access to data and resources that are scoped to the user. I guess model security is exactly the same as employee security, least privilege, sand boxes, etc