What is a common mistake when working with LLM security and prompt injection?

Assuming the system prompt alone can securely enforce authorization or keep secrets safe is a dangerous design mistake.