Separate contribution checks from privileged promotion

Start from the data flow: which text reaches the model, who controls each piece of it, and which tools a fooled model could call with whose credentials.

Then remove one control at a time and say what an attacker reaches next, which layer detects it, and what contains the damage.