Prompt injection is not what you think it is
Most people picture jailbreaks. The useful definition is narrower: a violation breaks a rule, an injection attacks the rule. Which means that without a policy there is no injection, only traffic.
Let an agent act for your customer without holding their access
The service you cannot launch is the one that acts on someone's behalf. It stalls because doing the work means holding their credential. It does not have to: the value can stay on their phone and never reach you at all.
The fifth review meeting
Why competent people keep refusing to approve agent projects, and why the argument they are having is not the one written on the agenda.
The objection stalling your agent projects is the credential
Every agent project that stalls stalls in the same place: nobody will sign off on putting a working credential inside it. Take the credential out of the application and the review has nothing left to refuse.