Defense framework enforcing routed origin policy to prevent indirect prompt injection in tool-using LLM agents, with deterministic origin checks and benchmark harnesses for evaluating attack success and utility retention.