[V7.3] Add technical requirements for content-based prompt-injection detection and multilingual/obfuscated payloads

Summary

Section 7.3 (Prompt Injection & Content Manipulation) currently contains only two requirements (7.3.1, 7.3.2), both governance/process-level. Neither requires an actual technical detection mechanism for injected content, and neither addresses multilingual or obfuscated injection payloads — a documented evasion vector for prompt-injection defenses.

Problem

• 7.3.1 only requires that risk has been "assessed" — there is no verification of what technical control results from that assessment.
• 7.3.2 lists isolation/confirmation as example mitigations but does not address content-level screening prior to acting on instructions extracted from a page or document.
• Neither requirement addresses that injection payloads are frequently delivered via non-English text, homoglyphs, or encoded/obfuscated instructions — a known technique for bypassing English/pattern-based filters (see MITRE ATLAS AML.T0051 – LLM Prompt Injection).

Proposed additions

• BSVS-7.3.3: a content-based detection requirement (semantic/classification-based screening before acting on untrusted content), positioned as a deeper technical layer beyond the isolation-based mitigations already covered in 7.3.2.
• BSVS-7.3.4: extends 7.3.3 to explicitly require that detection is not limited to single-language/pattern matching, covering multilingual and obfuscated payloads.

Scope clarification

These do not replace 7.3.1/7.3.2. 7.3.1 remains the governance-level risk assessment, and 7.3.2 remains the general mitigation requirement (including isolation-based controls). 7.3.3/7.3.4 add a specific technical detection layer, consistent with the L3 level already used for 7.3.2.

Suggested mapping

MITRE ATLAS: AML.T0051 (LLM Prompt Injection)

Happy to submit a PR with the exact requirement wording if this direction is agreed on by maintainers.

Start with Section 7.3 and review requirements BSVS-7.3.1 and BSVS-7.3.2, then consult the MITRE ATLAS AML.T0051 mapping cited in the issue. Done means maintainers agree on and add exact wording for BSVS-7.3.3 and BSVS-7.3.4 covering content-based detection plus multilingual and obfuscated payloads.