I was sort of thinking a final stage of the filtering pipeline - though prompt injection etc are risks.