Guardrails: System design
Specifies that untrusted retrieved or user content cannot authorize tools or exfiltrate secrets, that the model follows a documented instruction hierarchy, and that outputs are filtered before privileged side effects.
Stop aborts an in-flight generation stream, persists partial assistant text, keeps the user message, allows regenerate as a new attempt, and treats transport disconnect as distinct from an explicit user stop.