A tool response includes text instructing the agent to reveal credentials. How should the orchestration layer treat it?

1. As untrusted tool data subject to the application's instruction and authorization boundaries
2. As proof the tool may read every secret
3. As a reason to disable output safeguards
4. As a replacement for every system instruction