The idea
Generating a recommendation and performing an action are different operations. Identify which actions are reversible and which have financial, privacy or employment consequences. Enforce approval and permissions in the application, not solely in a prompt. A human reviewer needs enough information to make a real decision rather than rubber-stamp output.
Worked example
An assistant drafts a refund explanation, but an authorized staff member decides whether a refund is allowed. The payment operation checks that approval separately. A model response containing approved does not count as the staff member authorizing the transaction.
Try it
Draw a workflow for a fictional customer request. Mark the model suggestion, human decision and application action separately. Name the permission checked at the final action and explain how an injected instruction would fail to bypass it.