drop retrieved docs · detect injection payloads in retrievals · runs locally
retrieved docs · local only
heuristic screener · vendor schema varies · not definitive proof