Review agent safety and authority

The interpreter explains bounded evidence. It is not the authority that changes a Shutdown Gate.

Untrusted metadata

Catalog names, descriptions, documents, ownership, and query context are treated as delimited data, never instructions. Instruction-like metadata cannot add tools, widen scope or limits, choose a provider, mutate state, or expose secrets.

Tool and mutation boundaries

Analysis tools read only the target, replacement, discovered consumers, and persisted evidence bound to the run. There is no shell, filesystem, arbitrary URL, raw GraphQL, code-execution, or dataset-row tool. Application-controlled DataHub writes accept only server-generated, allowlisted kinds and targets, use a separate write credential, and require a fresh verification read.

Human authority and secrets

The model cannot select a replacement, approve a mapping or artifact, claim application, set gate state, verify write-back, or authorize shutdown. Tokens, database URLs, provider keys, raw prompts/responses, and private reasoning remain server-only and are excluded from public receipts and search assets.

Local Ollama can keep inference traffic on a configured host, but it does not remove risk from untrusted metadata, the model, the host, or the application.