This is how every LLM product works already. The problem is that the tokens that define the user input boundaries are fundamentally the same thing as any instructions that follow after it - just tokens in a sequence being iterated on.