You protect yourself against prompt injection in several layers. The first is the system prompt, the base instructions the model always receives. Then come sanitization of what goes in (input), validation of what comes out (output) and separate permission levels when the model calls tools and other systems.
The system prompt alone is never enough.