How do we detect prompt injection in production?

Runtime classifier (vendor guardrail or in-house) on both user inputs and retrieved content, plus structural separation of channels (system / user / retrieved / tool-output all treated as distinct trust levels). Log guardrail-trigger events for audit. A rising trigger rate is a leading indicator of active attack or drift.