Protect the operating system

Authenticate every caller and give each runtime its own identity. Limit tools and data to the job's scope.

Review source access, ingestion audience, indexed chunks, retrieval, caches, execution and publishing. A private source must not become public through a broader summary.

Keep secrets in the authorised runtime store and redact logs. Require approval before external communication, financial changes and other consequential actions.

Test revoked roles, unavailable sources, prompt injection in a document and failed releases. Source content is data, not authority to change the task.

Restore backups in isolation. Publish reusable checks, not private infrastructure details or incident metrics.