That wouldn't really fit what I just described at all. Obviously with current architectures, higher resistance to prompt injection is the best you can do.