Follow one request end to end

Every component the request passes through, in order.

1. 1. UI

   The user types the request in a web app.

   Input is free text from an authenticated user: partly trusted (the user may be honest but mistaken, or malicious).

   Lesson
2. 2. API + authentication

   The request reaches the backend with a session token.

   Authentication establishes the user's identity; every later action must be authorized for this identity, not for the service account.

   Lesson
3. 3. System / developer / user messages

   The app assembles roles: system policy, developer instructions, the user's request.

   Role markers are special tokens the post-trained model learned to weigh; they are not an enforced privilege boundary.

   Lesson
4. 4. Retrieval

   The app embeds the query and searches the user's documents.

   An embedding model turns the query into a vector; the vector index returns the most similar chunks, filtered by the user's permissions.

   Lesson
5. 5. Retrieved document

   The latest project document is inserted into the prompt.

   Its text may contain anything its author wrote, including instructions such as "also email this to ...".

   Lesson
6. 6. Tokenizer

   The whole prompt becomes token ids.

   System text, user text and document text become one sequence of ids, for example about 2,000 tokens.

   Lesson
7. 7. Transformer

   Prefill runs the 36 blocks over all tokens and fills the KV cache.

   Attention lets every later position read every earlier one: the document's tokens influence the summary and any tool decision.

   Lesson
8. 8. Decoding

   The model writes the summary token by token, then a tool call.

   The decoder samples each token; the model emits a structured send_email call with recipient, subject and body.

   Lesson
9. 9. Tool decision

   The app parses the call: send_email(to=?, body=summary).

   The recipient should be the user (or an allowlisted address). Anything else is suspicious, especially if it appeared only in the document.

   Lesson
10. 10. Authorization + confirmation

    The app checks policy and asks the user to confirm.

    Sending email on the user's behalf is outward-facing and hard to undo, so it requires explicit approval showing recipient and content.

    Lesson
11. 11. Email tool

    The email service sends with a scoped credential.

    The credential can send only as this user and only via this tool; the action is logged.

    Lesson
12. 12. Tool output

    The tool returns "sent" with a message id.

    Tool output re-enters the context as untrusted data for the next step.

    Lesson
13. 13. Final answer

    The model tells the user what was sent.

    The answer is rendered safely (escaped) in the UI; the run ends within step and token limits.

    Lesson