Sounds like you're saying the distinction shouldn't be between instructions and data, but between different types of principals. The principal-agent problem is not solved for LLMs, but o1's attempt at multi-level instruction priority works toward the solution you're pointing at.
They're not the same idea. One is about separating instructions and data, the other is about separating different sources of instructions, such that instructions from an unauthorized source are not followed (but instructions from an authorized source are).
