- They already do this. Every chat-based LLM system that I know of has separate system and user roles, and internally they're represented in the token stream using special markup (like <|system|>). It isn’t good enough.

- LLMs are pretty good at following instructions, but they are inherently nondeterministic. The LLM could stop paying attention to those instructions if you stuff enough information or even just random gibberish into the user data.