Guardrails: System design
Specifies that untrusted retrieved or user content cannot authorize tools or exfiltrate secrets, that the model follows a documented instruction hierarchy, and that outputs are filtered before privileged side effects.
Separates model proposals from runtime authorization: approvals bind high-impact actions, while idempotency only prevents duplicate execution and never grants permission.