Option A is the appropriate trust-boundary treatment for external content. Untrusted text can contain malformed data, adversarial instructions, prompt-injection attempts, or content deliberately constructed to alter the agent's behavior. It should therefore be validated or screened before inclusion and clearly represented as untrusted data rather than authoritative application instructions.

Anthropic's prompt-injection guidance distinguishes direct attacks from indirect prompt injection, where Claude processes third-party content such as webpages, emails, documents, or tool output containing hostile instructions. Anthropic recommends input validation and screening, least-privilege access, safe treatment of untrusted tool content, and screening content before Claude acts on it. Importantly, Anthropic notes that tool-result content is treated as untrusted data rather than as a reliable place for application instructions.

B erases the trust distinction and exposes the application to instruction/data confusion. C introduces a deliberately weaker security boundary and does not sanitize the data. D prevents legitimate use cases unnecessarily; untrusted does not mean unusable—it means the data must be handled defensively.

Therefore, A correctly combines validation with explicit trust separation. Relevant Study Guide topics: prompt injection, untrusted content, input validation, sanitization, data/instruction separation, least privilege, and defense in depth.