Trust-Boundaries

Design human approval around an exact operation, with reviewable payloads, durable decisions, expiry, and execution checks that survive retries.

How to keep model proposals separate from trusted application behavior with authorization, approval policy, current-state checks, and least privilege.

Indirect prompt injection is a trust-boundary failure; treat retrieved content as untrusted data, isolate it from instructions, and validate actions before execution.