Review this LOCAL AI/RAG boundary lab. No real model or external service is
connected. Read lab.mjs and lab.test.mjs. Identify trusted actor and ACL metadata,
untrusted document text, proposed model tool calls and the execution budget. Test
whether a document instruction, forged tenant field or unknown write tool could
bypass the gateway. Do not treat a system prompt, an opaque document ID, a vector
search score or a model’s user_confirmed flag as authorization. Produce evidence and
remaining integration requirements, not a claim of complete prompt-injection
resistance.
