Keep generated text and structured proposals outside interpreter authority

Use a bounded schema for a structured proposal, including allowed operation names, field types and collection sizes. Reject unsupported fields and nonfinite numeric values under the actual parser/validator contract. Then resolve resources and check current permissions using trusted caller context. A valid integer document ID may refer to another tenant’s data; a well-formed URL may point to an unapproved destination. Syntactic validity is necessary for the selected interface but does not establish ownership, intent or allowed side effects.

Bound the complete output and each nested collection before expanding it into tasks. A model that emits a thousand small actions can exceed a work budget even if each action is individually valid. Keep a server-side maximum on operation count and cumulative cost, and require any task-specific approval at the actual execution boundary. These are proposed application controls; a structured-output API or JSON Schema implementation does not automatically implement the resource, destination or authorization policy.

For ordinary UI text, use a text-rendering path. If HTML is intentionally supported, use an appropriate sanitizer and context-specific handling rather than treating arbitrary model HTML as trusted. For SQL, parameterized value binding separates values from query structure, while dynamic identifiers or operation choices need an explicit allowed mapping. A read-only account can reduce authority but does not authorize reading every tenant’s rows. The database must still enforce the actual access policy.

For operating-system work, prefer a narrow library or fixed executable interface with validated arguments over building a shell command string. Avoiding a shell does not eliminate argument injection: a tool can interpret an untrusted argument as an option or another control value. Bound and validate each argument under the chosen program’s contract. Paths, URLs, templates and Markdown have their own interpretation rules, so one generic escaping function cannot establish safety across all downstream contexts.

Test known-safe data containing punctuation, markup-like text, option-like strings and unauthorized target IDs against the exact downstream interface in an isolated fixture. Verify the expected rendered text, bound query values, argument vector or denied operation, not just the model’s answer. Use a stubbed model output when testing deterministic enforcement so a model’s refusal cannot hide a missing application check. Separately measure model behavior on representative prompts without interpreting that behavior as proof of the consumer boundary.

The network lab is a single sigmoid scorer, not an authorization engine. Reset and set both x=3,w=3, predict σ(8.5)≈0.999797, then Play or Step. Reset and set both x=−3,w=3 for σ(−9.5)≈0.00007485. The fixed bias is −0.5. A high score does not grant a principal permission to execute a proposed operation. The instrument trains no model and implements no JSON parser, HTML/SQL/shell interpreter, credential or policy decision.