Keys identify the caller; comparisons take constant time. The operator's and the seeded vendor's keys must be long random values on a public address, or RFX refuses to start.
People, not agents, sign, pay and approve: those calls need a person's name and an explicit confirmation, and the assistant can only propose them.
Levels are checked on every call that returns level-2 or level-3 content. A vendor's terms are shown to no one else.
Addresses a party gives (its MCP server, its key file, its identity provider) are never fetched inside a private network: the check is on the address the connection is actually made to, redirects are not followed, and reads stop at a size limit.
Rate limits on registrations, sign-ups and mail codes per client address.
Pages send a strict Content-Security-Policy with a per-response script nonce, no framing, no MIME sniffing, and HSTS on https.
Text from the other side (documents, RFPs, messages) is data to every model RFX uses, never an instruction.
Data is in Postgres on a private network with no route outside; RFX connects with a role that owns its tables and nothing else. Files are in a private store.
Containers run without privileges and with a read-only filesystem where possible.