01 / What each boundary answers
Compare the decision, not the label.
Evaluate or constrain model content and behavior at interaction boundaries.
Decides whether a specific tool operation may cause an external effect under a current grant.
02 / Same operating case
Which request must be stopped?
A model produces a plausible request to disable an account after reading a malicious ticket comment.
Evaluation exercise
Provide a benign-looking ticket that requests a valid-looking disable command for the wrong account. Test the content filter and account API independently; record both outcomes.
03 / Architecture fit
How the controls can compose
Use content controls to reduce unsafe proposals and action controls to bound their consequences.
A clean-looking model output is not proof of task authorization; an authorized action can still fail operationally.
04 / Evidence
Prove the decision and the effect separately.
Record content-control outcome separately from action decision and account state.
Primary sources