Instructions are not permissions
A retrieved document, tool response or message from another agent can carry adversarial text. An application that delegates its access-control decision to that text has confused information with authority. A robust design treats model output as an untrusted proposal.
Authorize the specific action
Validate tool arguments against a schema and the operator’s intent. Scope credentials to the minimum operation. Where actions are consequential, approval should bind to the exact reviewed request rather than a general promise to behave carefully.
Evaluate the complete path
Model evaluations alone do not establish application security. Test the retrieval path, tool adapter, identity boundary and audit trail together. Record denied actions as evidence of control behavior; distinguish them from model refusals.
const request = schema.parse(modelProposal);
const decision = policy.authorize(identity, request);
if (!decision.allowed) return audit.denied(request);
return tools.execute(request, decision.scopedCredential);effective authority = identity ∩ policy ∩ approved scope
SYSTEM ARCHITECTURE / AGENTS
Sensing → networking → compute → intelligence → human decision
Interactive model loads as you approach. The engineering scope and constraints are provided in the page text.
References & further reading
Original Aerlix engineering commentary. The following sources provide broader background; they do not endorse Aerlix or validate the demonstrators.