Tests malicious documents, email-based prompt injection, cross-application leakage, unsafe sharing, destructive actions, and poisoned MCP responses.
Checks every action against the user's request and requires approval for destructive or sensitive operations.