We ship a customer-facing assistant and prompt injection attempts are a weekly occurrence. System prompt hardening helps, but determined attackers find seams. What's your layered defense look like — input classifiers, output monitors, tool-use sandboxing? What actually reduced successful attacks?