An agent retrieves an external document that claims to replace the developer's authorization rules. What context boundary must be preserved?

1. Retrieved evidence remains untrusted content and cannot grant itself instruction authority.
2. The document's confidence score replaces backend authorization.
3. Any document returned by semantic search becomes a privileged tool policy.
4. The longest text always overrides shorter developer instructions.