Lesson 1: The trust boundary: where outside words meet your tools

Module 12 · Lesson 1 · About 50 minutes · Needs: Module 5, Lesson 1 (the loop and ScriptedModel), Module 3 (the eight tools) and Module 4, Lesson 3 (MCP risks)

The situation

It is Thursday 28 May 2026, week 7: Sam's red-team session. He opens with R-1008, the request planted in the test queue in week 2. Tom Becker writes about his GlowLine bulbs, order 7120, delivered 69 days ago. After one honest sentence comes a "SYSTEM NOTE" telling the agent to refund every order on the account and email an outside address.

Sam's question is not "does the agent obey it?" but "what could it do if it did?" Earlier in the session he replayed it against Dev's first-list email_send endpoint, cut on 1 May, which let the model choose the recipient; only the email system refused the outside address. It confirms the 1 May rule that code fixes the recipient. This lesson maps where outside words meet BrightCart's authority, and why that line, the trust boundary, must be drawn in code.