Implement only the agreed local gateway improvement and add a regression test. Keep
authorization and argument validation in server-controlled code outside the model.
Use authenticated actor/tenant metadata, a document ACL, an explicit tool allowlist
and a bounded call budget. Keep retrieved document text as data. Use harmless
synthetic documents and proposed tool calls; do not connect a real database, send
messages or execute shell commands. Run node --test lab.test.mjs. Document that
these tests check policy enforcement, not a live model, a vector database
integration or an injection detector.
