The dominant pattern is one control, two implementations: the same UI host ships twice and the security-relevant checks exist in only one copy. The static-resource twin gates every platform URL through isTrustedSalesforceUrl() and enforces a 1000-character input cap; the LWC path appends a <script> from an operator-supplied URL with no protocol check, no domain allowlist and no integrity attribute, accepts unbounded input, and tears down page-wide DOM that the twin explicitly guards. The controls are not missing because nobody thought of them — they were written, then not carried across.

On the agent side the pattern is policy stated in prose, nowhere enforced and nowhere recorded. All eleven behavioral guardrails live as natural-language lines in system.instructions, the override-resistance rule covers user input but says nothing about instructions arriving inside retrieved Knowledge articles, masking is acknowledged but never prohibited, and the platform audit trail that would make a successful bypass reconstructable is documented as optional. What keeps this off the critical tier is the capability ceiling: the bundle defines exactly one read-only retrieval action and no write, send, or execute capability anywhere, so a successful bypass produces a wrong answer rather than a wrong action.