Guardrails and failure modes

The model is not a security boundary

Text that arrives from a document, a web page, or a tool result can contain instructions. If your prompt concatenates it with your own rules, the model has no reliable way to tell which is which — that is prompt injection, and it is a data-flow problem, not a prompting one.

Permission checks belong in your code, keyed on the authenticated user. A model instructed not to access other tenants data is a request, not a control.

When output fails validation, fail closed. Passing through a partially valid object because the call was expensive is how a bad value reaches the database.