Prompt injection detector is useful as a signal, but it cant be the security boundary. Credentials, egress, permissions, and irreversible actions must be enforced outside the model.