Separate model behavior from system security. Even an unreliable model can be deployed safely if capabilities, egress, credentials, and state transitions are enforced outside it.