I think this is already implemented and called message roles: system, user, tool and assistant (ordered by authority). Untrusted data shall only be injected in

I think this is already implemented and called message roles: system, user, tool and assistant (ordered by authority). Untrusted data shall only be injected in tool responses, which are less authoritative. But at the end, this all ends in the big token stream - so this is not a perfect separation.