A manuscript sentence about posting elsewhere must not change the actual destination. A visited page requesting more authority is not a new human instruction. I separate reading data from task-request provenance and carry that distinction into the checks surrounding tool execution.
The same sentence has different authority on another channel
Pages, references and sample manuscripts can contain imperative sentences. Treating their wording as a new human request can turn reading into another action. Request-sites is designed around the current human message, without page text, history or skills manufacturing another destination.
The function still receives a string from its caller. If that caller incorrectly supplies page content as the current request, the parser cannot authenticate every semantic distinction. Trusted input provenance and interpretation rules are both required. I therefore do not describe this small parser as a complete prompt-injection prevention system.
Separate manuscript title/body fields from routing instructions
The implementation recognizes paired Korean title/body fields and uses the preceding portion for routing. It is a narrow heuristic to stop account and platform examples inside a manuscript from replacing its destination, not a promise to understand every language and document format.
The fixture names a current writing tab and places other accounts, services and addresses in the body, requiring the original destination to remain. Explicit account choice before manuscript fields is preserved, while an unknown account remains ambiguous. That ambiguity must not be covered by choosing a convenient default account. Ignoring manuscript examples differs from ignoring the human's actual target selection.
A reference site differs from a publication destination
RequestSites does not treat every mentioned platform as another destination. It distinguishes topic discussion, intended asset use and negation, and classifies reference versus destination roles. Reading material from a source and writing to that source require different authority.
The role classifier uses bounded string rules and can still misunderstand wording. Its classification is not proof of the logged-in account or publication permission. Tab, profile and task-scope checks remain necessary downstream. Even a more capable interpreter could not make those checks redundant merely by assigning a role to a sentence.
The host owns execution state even if a page names an error
ActionBroker parses calls through ToolCall and checks run epoch/status plus tab ownership, profile and project. Prepared/dispatched records and retained pending outcomes belong to that host boundary. A page containing an error code or confirmation sentence does not make it the actual dispatch state.
ToolExecutionError likewise represents host-classified failure. A model or page description must not manufacture retry authority. Yet syntax and scope validation do not prove every semantic action matches the human's intent. I retain mechanically checked boundaries separately from meanings that still require judgment.
Distinguish tested cases from blocking every attack
I reviewed current parsing, broker code and structured fixtures without running a new malicious-site or model-attack test. A manuscript-routing fixture is concrete regression evidence, not certification against every instruction-injection form. The old alpha threat model is not copied as a current product-wide guarantee.
The linked synthetic work-context module compares request-bound scope but does not authenticate where original text came from. Reuse the order of separating provenance before trusting persuasive wording, then checking current request, target and result at the action boundary. Reading convenience should not silently become new authority.