Privileged model

The model in the quarantine pattern that plans and calls tools. It never sees the untrusted text, only the quarantined model's structured output.