If you know agents email address, it can still be Prompt Injected.. what prevention exists there ?

we have a few things in place, allowlists and permissions act as a layer. also beginning some work on prompt isolation within api soon. but having an isolated identity + data within a separate agentic inbox also puts less risk of your personal email data being injected - which is most people's main concern