Great summary. Also, some of these seem like they can be combined. For example, "Plan-Then-Execute" is compatible with "Dual LLM".

Take the article's example "send today’s schedule to my boss John Doe" where the product isn't entirely guarded by the Plan-Then-Execute model (injections can still mutate email body).

But if you combine it with the symbolic data store that is blind, it becomes more like:

    "send today's schedule to my boss John Doe" -->
    $var1 = find_contact("John Doe")
    $var2 = summarize_schedule("today")
    send_email(recipient: $var1, body: $var2)

`find_contact` and `summarize_schedule` can both be quarantined, and the privileged LLM doesn't get to see the results directly.

It simply invokes the final tool, which is deterministic and just reads from the shared var store. In this case you're pretty decently protected from prompt injection.

I suppose though this isn't that different from the "Code-Then-Execute" pattern later on...