Security and guardrails

Secure action flow: LLM proposal → allowlisted tool → identity/authorization → schema + rules → limits → business service → minimal result.

Attack surface: user prompts, PDFs, websites, email, memory, tool descriptions/results, arbitrary URLs, caches, traces, and exposed local-model endpoints.

Controls: least privilege, tenant/object/action checks, trusted tool catalogs, secure uploads/parser isolation, constrained egress, PII minimization, runtime schemas, output grounding, safe rendering, quotas, reviewed writes, and retention/deletion across derived data.

Guardrail distinction: schemas check shape; moderation checks product policy; PII checks support minimization; business rules enforce domain validity; authorization controls access; approval permits a concrete action. None alone replaces all the others.