1 INBOUND PROMPT SCREENING

Filter prompts, jailbreak attempts, PII at the edge — before the manager sees them.

LLM01 • LLM02 • LLM07 • ASI01

2 MANAGER → WORKER DELEGATION

Verify the manager has authority to delegate; sign the delegation with a short-lived token.

ASI03 • ASI07 • ASI10

3 DIRECT TOOL AUTHORIZATION

Re-validate worker's scope, intent, and arguments before any tool runs.

LLM05 • LLM06 • ASI02 • ASI03

4 TOOL OUTPUT SANITIZATION

Egress filter: detect exfil, redact PII, strip injected instructions before output returns.

LLM02 • LLM05 • ASI06 (memory)

5 SPECIALIST-SIDE DECISION

Worker re-checks the manager's signed token + policy at decision time — no bare trust.

ASI03 • ASI07 • ASI09

Key principle: never trust an upstream agent's word. Every control re-validates intent, identity, and scope against signed policy — even when the upstream agent is your own.