What GuardLLM knows outside the model

Per-flow context is supplied by the host on every call. It is never inferred from content, and it is not retained between flows.

You are here
SourceIngressAuthorizationSink

Host declares source_trust = untrusted

1. Ingest

STATE RECORDED
The isolation wrapper records what the host said this source was.
<untrusted_content source="mcp_server:wiki.example.com" trust="untrusted">

2. Session state after ingest

STATE RECORDED
Contamination tracks the declared origin, not the text.
context_contaminated = True

3. The proposal

BLOCKED
The contamination gate runs before the policy engine and returns there, so this call never reaches policy evaluation.
Authorization required: session contaminated=require_auth

Host declares source_trust = trusted

1. Ingest

STATE RECORDED
Identical content, identical call, one declared field changed.
<untrusted_content source="mcp_server:wiki.example.com" trust="trusted">

2. Session state after ingest

STATE RECORDED
The same text does not contaminate this session.
context_contaminated = False

3. The proposal

ALLOWED
The identical non-destructive tool call, evaluated through policy and recorded at the rate limiter.
Non-destructive tool, implicit allow

The detector saw one text and gave one answer: both columns matched instruction_override, so the divergence cannot be explained by what was detected. Only the declaration differs.

Why per flow and not per session: trust, sensitivity, and content type describe one flow, and a single session commonly mixes flows. An operator instruction and a retrieved web page arrive on the same session and must not inherit each other's trust. What GuardLLM retains across a session is state it derived itself: contamination, provenance, DLP history, and rate counters.

Evidence, scope, and reproduction

Scope and instrumentation

This page runs one text through two sessions that differ in a single declared field, so the effect of the declaration can be read off the results rather than argued for.

Adversary A1Ingress → AuthorizationT-IN1A-AS1 · A-AS8Source: SecurityContextTest: tests/test_demo_scenarios.py

Exact fixture test: tests/test_demo_scenarios.py::test_security_context_fixture

.venv/bin/python -m pytest tests/test_demo_scenarios.py::test_security_context_fixture -q

Generated fixture