"Never put a security decision inside the prompt" is the right one-liner, and framing it as four parties with trust boundaries teaches it better than a threat list does.

The MCP tool servers deserve extra weight: they are usually third-party code holding real credentials, and most builders inherit their permission model without reading it. Two additions. Tool output is an input, so a compromised or merely sloppy tool server can inject through its response, which means untrusted-data handling applies on the way back and not only on the way in. And an approval gate only works if the human sees the resolved action rather than the model's description of it. "Send a summary to the team" and the actual recipient list are different objects, and the gap between them is where the attack lives.