Educational / lab material. Use only a local model, fictional documents, and a simulated endpoint.
Draw the trust boundary
I split the system into prompt, retrieval, tool or action, and audit. Each area has a different kind of untrusted input. The important question is not “is the model intelligent?” but “which actions can happen without human confirmation?”
Safety checklist
- Does retrieved data have a clear scope?
- Is the output treated as a command or only as a suggestion?
- Do tools have an allowlist, timeout, and enough logging for investigation?
- Is there a clean path to separate the model from any real system?
Good design usually reduces permission before increasing capability.