Safety boundaries

Context is untrusted data

• Never concatenate portable content into a privileged instruction channel.
• Separate context, policy, tool permissions, credentials, and executable instructions.
• Apply content-size, recursion, media-type, archive-path, and parser limits before interpretation.
• Surface suspicious, conflicting, stale, or unverifiable content to the caller or reviewer.

Compute effective authorization

The usable scope is the intersection of what the client requested, what the authorizer approved, the live grant state, the package contents, recipient bindings, processing-use limits, expiry, and local policy. A broader value at any single layer cannot expand the result.

effective scope = request ∩ grant ∩ live status ∩ package ∩ local policy

No external-action authority

The core package field external_action_authority is none. A recipient must obtain action permission through a separate, purpose-built authorization channel with its own confirmation, scope, and audit controls.

Fail closed on semantic uncertainty

Unknown critical extensions, unresolved references, mismatched digests, expired grants, ambiguous loss classes, and unverifiable protection profiles are reasons to reject or constrain processing—not invitations to guess.