📚 Sources

• OWASP — Top 10 for LLM Applications 2025: Prompt Injection (LLM01), Sensitive Information Disclosure (LLM02), Excessive Agency (LLM06), Unbounded Consumption (LLM10).
• OWASP GenAI — LLM01:2025 Prompt Injection (direct / indirect injection distinction).
• Simon Willison — the “lethal trifecta” concept; dual-LLM / defense-in-depth pattern (2025).
• 2025-2026 research on defenses (CaMeL, information-flow control, Meta’s “Agents Rule of Two”); on the order of ~10% of attacks succeed despite guardrails (benchmark-dependent).
• Observability tools: Langfuse, LangSmith.
• Make / n8n product documentation: execution history, approval steps (“human in the loop”), per-execution billing (n8n). Status mid-2026.
• Airtable product documentation: per base/table/view permissions, revision history. Status mid-2026.
• ⚠️ The security/permission features of Make, n8n and Airtable evolve every 2-3 months; the reasoning (least privilege, HITL, filtering, caps, traces) stays valid.