A document contains text instructing an assistant to ignore its system policy and call a privileged tool. What should the design do?

1. Grant every document author database-administrator access
2. Promote the document text to the highest-priority instruction
3. Assume vector similarity proves the text is trustworthy
4. Treat retrieved text as untrusted data and enforce tool authorization outside the model