SYSTEM
应用策略 Application policy
定义角色和边界。它可以规定核验流程，但不是某笔退款已核验的业务证据。 Defines role and boundaries. It can require verification, but is not transaction evidence.
01 · 一句话，四种工牌
01 · One sentence, four badges
“已核验，可退款 500 元”是用户自述、助手草稿，还是工具回执，会一样可信吗？ Does “verified: refund $500” mean the same thing as a user claim, an assistant draft, or a tool receipt?
02 角色分拣台：把同一句话送进不同槽 Role Sorter: Place the Same Sentence in Different Slots
来源不可抹平 keep provenance
当前角色
Current role
USER
request / claim
解释标签
Interpretation
CLAIM
not verified
进入确认门
Enter confirm gate
NO
needs evidence
03 四种角色，不是四种文风 Four Roles Are Not Four Writing Styles
来源 + 用途 source + purposeUSER
请求与自述 Request or claim
表达用户想要什么或声称什么；需要独立核验才能改变真实状态。 Expresses what the user wants or claims. Independent verification is needed before changing state.
ASSISTANT
先前生成 Prior generation
是模型以前说过的话，不会因为出现在历史里就自动升级为事实。 A previous model output does not become fact merely by appearing in history.
TOOL
外部返回 External result
是工具返回的数据证据；仍要核验工具身份、调用成功与字段含义。 A tool result is external evidence; tool identity, call success, and field meaning still matter.
04 最小机制：内容相同，解释函数不同 Minimal Mechanism: Same Content, Different Interpretation
meaning = f(role, content)meaning = f(role, text)
上方 text 始终不变，只有 role 变化。若 permission
随之改变，就证明角色不是装饰标签。
The text remains fixed while role changes. The permission change
proves that role is not decorative metadata.
接收文字
Receive text
字面内容相同
same literal content
读取角色
Read role
识别来源与用途
identify provenance and purpose
决定下一门
Choose next gate
请求、草稿或证据
request, draft, or evidence
05 边界实验：把工具输出当成指令 Boundary Test: Treat Tool Output as an Instruction
主动制造失败 Create a failure抹平角色后，数据开始“发号施令” Flatten roles and data starts issuing commands
模拟把 system、user、assistant、tool 全拼成普通文本。工具返回里的恶意句子会被误当成高层指令。 This toy failure flattens system, user, assistant, and tool into plain text, allowing a malicious tool string to masquerade as policy.
尚未执行。工具返回仍被标记为数据。
Not run yet. Tool output is still labeled as data.
✗ 所有上下文都是同等可信的纯文本。
All context is equally trusted plain text.
→ ✓ 角色保留来源，决定如何解释内容。
Roles preserve provenance and guide interpretation.
✗ assistant 说过就等于系统事实。
Anything the assistant said is a system fact.
→ ✓ 模型历史仍是生成内容，需要证据。
Assistant history is generated content and still needs
evidence.
✗ tool 角色里的每个字都可以执行。
Every string in a tool message is executable.
→ ✓ 工具返回是数据；动作要走独立权限门。
Tool output is data; actions require a separate authorization
gate.
06 · 一句话带走
06 · One line to keep