护栏：系统设计
指定不可信的检索内容或用户内容不能授权工具或外泄机密，模型遵循有文档记录的指令层级，并且输出在产生特权副作用之前会经过过滤。
Selects models by declared capability, data-handling policy, and cost budget with explicit forbidden fallback paths so sensitive or high-assurance requests never downgrade to disallowed tiers silently.