Agreed on the central rule, and the chatbot-versus-agent distinction is the part people skip. A wrong sentence is embarrassing, a wrong action is an incident, and the same injection produces either one depending only on which tools happen to be wired up.

One thing worth adding even at this length: permissions should be scoped per task, not per agent. An agent holding the union of every permission it might ever need is one injection away from using the worst of them, so the useful pattern is a narrow short-lived credential for the current task with everything outside it failing closed. Memory poisoning also deserves more room, since it is the only item on your list that survives after the malicious input is gone.