You can't stop every prompt injection. But you can decide what a successful one is allowed to do. A product security playbook for agentic features.