Documents are evidence, never instructions
A demand letter is written by someone who would like your system to do what it says.
- Every model call runs through one gateway with a registered task profile and a policy no prompt can override. Undeclared tools are refused before anything leaves.
- Correspondence, attachments, tool results, and the model's own earlier output enter every call labeled as untrusted evidence with their lineage attached.
- Capabilities are checked at the moment of use against the person's actual claim scope. Model-written arguments cannot widen it, and a report needs a person to ask for it.

