The end state of this subject is not a better prompt. It is an architecture where the instruction and the data never share a channel, so the strongest injection in the world has nothing to aim at.
About 1 min of reading
Audit the one merge point
Find every place user text is concatenated
Before you run it, say out loud what it will print. Then open the answer.
Name the one allowed merge
Before you run it, say out loud what it will print. Then open the answer.
Attack the merge and require a fail
Before you run it, say out loud what it will print. Then open the answer.
One merge point means one place to audit. Every input list in the Basic tier points at that same function.
An attack that tries to close the data channel and fails, on the running system, is the proof. Not a claim in a document.
The instruction channel is written by code and read by the model. The data channel is written by users and read by the model. They merge once, and the merge is a function.
A marker can be guessed or copied. A channel that is a separate field in an API call cannot be entered from inside the other field.
It costs a rewrite of the request builder. That cost is why it is done once, at the bottom, instead of per prompt.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.