Merlin is a probabilistic defense-in-depth control and can produce both false negatives and false positives. Do not make it the sole boundary protecting credentials, money movement, external communication, code execution, or other high-impact actions.

Use least-privilege tools, deterministic authorization, sandboxing, explicit confirmation for consequential actions, and auditable fail-closed handling.

Report vulnerabilities privately to security@kontext.security. Do not include real credentials, personal data, or live exploit payloads in public issues.