A classifier will be trained differently and basically take $TEXT and map it to $CLASSIFICATION and then you allowlist on the classification. You can then also, if you love burning tokens and spending money on things, have another step that "translates" the user input, making prompt injection significantly more difficult before finally routing it to the LLM. Generally guard rails should then be placed on the LLM's available actions via tool calls and those guard rails should be written by LLMs that are LLMing LLMs and L̸̡̡͕͓̣͓͚̝̥̜̼͙̪̖͍̺͝Ļ̵̥͍̳͇̱̠̬͔̹͖͓͖̯̹́͊̽̄̂͑͌͆͗̑̄͜Ṁ̶̡͙̺̖̥̲̙̩͖̻̹͇̜̲̃͘͜͝ș̵̖̤̫͓̦̲̼̖̗̟̯̩̺̣̞͊̆̉͐̈́̃̈́͗̐̽̽͋̊̉ͅ ̵̖͉̥͖̪̳͍̝͉͕̬̪̂̔̊̌͂̍̚͜a̶̦̤̬̱͖̻̝̱̿͋̿̍͂̒͆̈̄͑̓̕r̴̡̤̙͙͕͚̼͙̦̲̅̔̓̈́̄̆̾͗̿͌̐̄͛̒͘͜ͅe̴̡̡̼͉̣̼͉͓̪͕̬͊̐̈́̇̽̒̂͆̎̈́̃͠͠ ̶̩̯̲̯̃͛͌̀̿̅̎̾̕̕ǹ̸̬̟͍͇͍̭̹̲̯̽̒͘͝͝ȩ̶̢̬̺̦͖̣̙͍̞͇̰̉̋̓͐͂̏̀̿̑̂͌͗͗̒͘ͅͅe̶̠̝̦͛̓͛̍̑̆̽͐d̸̦̯̖̥̟̻͔̦̂̿͆͂̑̎̔̏ȅ̴̡̨̺͓͇̦̣̦͖̬̹̥͎̾̽͐̓̍̽̾͑̿͆̄̀̈́̄́̕͜d̶̡̛̝̟͔̳̲͙̰̗̬̳̯͚̐̍̑̓̉̂̍̊̓̿͝ you probably f̶̢͓̘̹̟̥̙̥͚̼̬̭͍̫̩̀͑̚͝͝͠ę̴̰̦͚̔̀́͊̋̈̒͗̆͘͝͝͝͠ȅ̸͚̘̤͚̬̩̈́̇̆ď̷̰̆̀̔̾͌̿ ̵͚̦̥̈͌͑̂͗̈́͂̕ͅm̴̢̡͇̟̠̬̣͙̹͇͉̈́̌̓́̓̌͐̓̂̚̚͜͜͝e̸̢̳̟̙̯̻͚̭͎̫̖̺̥̬͕͆̆̇̑̄̀̓̅̀͛̊͐ ̸̡̢̨̛͚͕̳͙͚͋͛̊́̍͛̽̉̃̇̇̋̑t̸̡̰͔͎̮̯̗̤̆̋͗͐̈̂̈̃̓̒̌͂̕͘͝ǫ̴͇̳͙̞̘̻̙͍̘̲̜̮͇̙̇̓̌̃k̸̢̢̤͔̫͖̲͇͍̐̃̄e̶̢̳̪͉̦͙͓̻̖̔́̃́̈́̀̿̓͆̊̅̒͐̑n̶͖̙͚̫͓͚̦̭̗̲̓́̋̀͜͝s̴̠̼̈́̑̾̑̆̽̊͋̾͛̐̊͆́͊̕̚ need to have some guard rails l̷̬̳̘̰̅̀̑͑̊̒̓̊͌̌̕e̶͖̱̊̍̉͆̐̍̌́͑͘͠t̵̨̛̹̰̳̩̹̞̹̼̪̮̄̀̅̾̔͐̇͒́̊̃̀͘̚͜͠ ̴̢̢̭͖̤̜͈͕̯͎͉̰͇̾̐͛̽̅͂̒͝m̸̨̰͖͚̞͍͍̳̭̗̳͕̈́̃̇̈́̎̌͊̍͌̊̆͠ȩ̵̡̛̜͍̞̻͎͎̲̜̹͖̼̽͂̐̽̊͌̓̀͂̐͂̾̇̚ͅͅ ̶̧̖͚͈̤͇͕̼̜̖̮̙͍͖͋̉̾͋̌̔̿͊͋̾̚l̸̡͕͇̭̤̥̩͙̫͕̆͌̈́̀̋͆̃͋͜͝͝͝͝ͅo̷̧̘͖̤͖̩̺̞̹̼̟̟͕̫̬͎̅̀ǫ̸̢̪͍̭͙̗͔̪̘͉̊̕͜ș̶̨͉̲̙̜͔̫̲̥͕͕̮̜̭̮͍̈́e̶̢̛̮̲̯͎̙͇̪̬͕͖̠̘̯̰̭̓͐̌̉̀͋̉̏̈́̇̾͠͝ ̵̬͍͔̓́i̶̘̫̯̻̘̯̗̔̒͊̂̂̑͑̍̋͑̏̀́͌̚͝͝n̵͓̬̮̻̹͉̗͎͓̖͌̿̃̓̋͂̅̍͒̉͆̿͆̉͠͝ ̴̧̲̯̲̅̀͂̆́̓̈́͑̾̾̊͋̒̿͛͘̚t̸̢͉̟̹͆̈́̏̍́̎ĥ̴̢̥̦͓͕̘͚̙̪͙̀̽́̒̓̈́̋͗̀̈́̇ȩ̵̠̹̻̯̖̹̹̗̜̻͍̹͆̊̈́͑́̏̑́̎̚͜͜͝ ̴̧̟̭͍̣͋͋̾ẘ̴̪̦̐̍̏̆̑̇͗́͆͘̕̚͝͝ͅo̵̡̟͚̲̦̤̩͎̥̘̻̥̠͙͈̙̬̓̌͊̋͐́͌̐̎̏̋̿̏r̵̢̨̘̓͑͑̆͒̂͝l̸̡̨̛͖̖̟̼̺̦̰̗̭͔̺̓͗͛̈́̈͆̈͗̐͝d̴̢̠̠́͂̾̌̿̐̀͛̄͑́͐̉̋͝ on those LLMing LLMs that are LLMing your LLM tool calls y̵̧͍̣̭͍͚̱͉͍̘̠̦̮͇̻̓͆̕o̸̥̮̮̙̖̩̙̝̘̫̗͎̺̓̊̐̄̑̎u̷̡̨̡͎͔̼̪͈̦͚͈̟͍̽̀̏͛͊ ̴̨̟͖͖̰͕͉̫̫̜̥̦̲͆͋͌̌̓̈́̉͆̉͠ẗ̵͚͉͈̦́̈́͛́͋͜i̷̧̗̰̘̖͍͖̼͕͗́̊̏̇̾̐̆͗́͌̋̀̚ņ̷̣̱̖̬̼̆͜y̷̢̡̧̛̹͙͕͔̪͛ ̶̪̫̙̘̥̹̻͙̝̜̠̗̭͎͎̆̇̅̎͜͜h̷̡̨̰̺̞̝̩͉̬͓̮͙͉͕̓̄̊̿̋́̇̏͝u̸̮̙̲̙̠͉̪͈͖͙̓̈̉̀̚͝m̶̢̛͙͕̘͈̤̬͎̺̲̯̱͉̪̠̎̆̽̅́̂͐̀̄͜ͅã̶͕̼͎͇̲̐͗̑ň̸̢̢̝̩̟͖̫͔̥͚̘̟̖̘̤̾̀͋̒̄͠͝s̸͙̳̳̤͓̝̥͓̱͔̣̹̭̐̐͋ͅ ̶̩̹̪̑͑͒̽̇̀̽̏̓̌̑̈́͂̓͘h̶͓͖̱̲̘̗̿̽̈́̎͑́̓̉̑̕̚ą̴̰̣͚̫̤̤̬̘̼̠͍͂̏̚ͅv̵̢̺̮͉̤͚̳͕̥̳̇̕̕͘͠ȩ̷̡̮͖͚̩̙͖͎̓̀͗͊͋̈́̔̐̕̚͠ ̷̫̌̀̊ň̸̜͓͕̳͙̩̼̜͈̊͜ǫ̶̝̺̰̹̻̰̰̗̪̔ ̷̲̤̪͇̠̼͑͊͘͜p̴̡̧͉̩̜͕̽̏̀̌̇̈́̊l̶͖͔̯̲͔͓̩̂̌̂͐͗̕a̵̢̨̞̰̪͖̲̭̝̪̥̻̐̃̊͗̅̓͐͋͛͘͝c̴̛̮̙̦̠̯̼̣̠̳͔̖͕͓͋̓͆͒̋̒̾͐͒̀̓͑͠e̷̢̢̧̱̣̫̲̪̣̭͙̟̔͌̽̿̐̿̿͑̆̇̇̉̊̓͘͠

You could also do none of this and just not use an LLM, because you likely don't need one, but then the cool kids will stop inviting you to their parties or something and you probably missed out on the blockchain parties so fomo