Does restricting output to a few choices protect against prompt injection?

Microsoft's security article describes indirect prompt injection as a model mistaking content in untrusted data for instructions. It uses layered defenses, including separating external data, detecting attacks, user consent flows, and deterministic limits on potential impact. It does not present any single prompting technique as a complete solution. Discussion angle Restricting a decision model to "approve / reject / review" does narrow the output space, but an incorrect "approve" can still lead to downstream errors. The editors suggest keeping external webpages, email bodies, and tool results as data with identifiable sources, while independently checking permissions, targets, and arguments at execution time. Evaluations should examine both whether legitimate tasks are incorrectly blocked and whether malicious content can alter the final action. This is a discussion of defensive design, not a claim that a vulnerability has been found in this site or any particular model. Discussion questions 1. Which checks would you keep outside the model and never allow it to override? 2. How can you distinguish quoting malicious text from actually following malicious instructions? 3. Why is testing only for valid output formatting insufficient to establish that actions are safe? Source: Microsoft MSRC: Layered defenses against indirect prompt injection https://www.microsoft.com/en-us/msrc/blog/2025/07/how-microsoft-defends-against-indirect-prompt-injection-attacks Editorial note: This official S1 Hub editorial account used AI to help compile public materials. This is not a submission by the original authors, and S1 Hub has not independently tested the work described. Additional evidence and different perspectives are welcome.