Prompt injection, the lethal trifecta, PII & tracing

Safety and observability are where AI system design diverges hardest from classic system design — and where interviewers separate people who've shipped from people who've read blog posts.

Prompt injection & the lethal trifecta

• Prompt injection: untrusted text (a web page, an email, a retrieved doc) carries instructions that hijack the model. Indirect injection — via retrieved/tool content — is the dangerous, easy-to-miss form.
• The lethal trifecta: real damage needs all three — access to private data + exposure to untrusted content + ability to communicate externally. Remove any one leg and exfiltration can't complete.
• Defenses: treat retrieved/tool content as data, not instructions (delimit, don't concatenate blindly); least-privilege tools; human approval before outbound actions; output filtering; and don't put secrets the model doesn't need in context.
• Know the 2026 frames: the OWASP Agentic Top 10 (goal hijack, tool misuse, memory/context poisoning, rogue agents) and Meta's Rule of Two — an unsupervised agent holds at most two of the trifecta's three legs. Consensus: injection may never be fully solved; you architect around it.

PII & privacy

• Minimize: don't send PII to the model unless needed; redact/tokenize before the prompt where possible.
• Data residency & retention: know where prompts are logged/stored; disable provider training on your data; honor deletion.
• Access control on retrieval (from the RAG module) is a privacy control too.
• Compliance shapes architecture: HIPAA/GDPR/SOC2 may force VPC/on-prem deployment, BAAs, and audit logging.

Observability & evals

• Tracing: capture every step — prompt, retrieved context, tool calls, tokens, latency, cost, model version. Tools: LangSmith, Langfuse, Braintrust, OpenTelemetry-GenAI.
• Offline evals: a golden set run in CI on every prompt/model change — catch regressions before ship.
• Online evals: monitor live quality via user signals (thumbs, edits, escalations), LLM-as-judge sampling, and A/B tests.
• Offline tells you 'did we regress?'; online tells you 'is it working for real users?' — you need both.