External email, Slack, Calendar, and Notion content is untrusted data. ContextOS never treats retrieved content as instructions.

Controls:

• Prompt-injection detection for common malicious phrases.
• Delimited source-content prompts.
• Least-privilege tool permissions.
• Gmail, Slack, and Calendar are read-only.
• Notion is the only write target.
• Secret redaction in structured logging.
• Validation rejects unsupported factual claims.