A retrieved web page tries to instruct an agent to transmit confidential context to an external address. Which approach best fits?

1. Grant a narrowly scoped read identity and withhold mutation capabilities.
2. Enforce a concrete approval gate before executing the action.
3. Validate the identifier and enforce tenant authorization in trusted code.
4. Keep source text untrusted and enforce tool and egress authorization outside the model.