"Architectural property" is the right level. If an agent can read untrusted material and use tools with real reach, the system has created a channel from text to action. That cannot be patched by asking the model to be more suspicious. The architecture has to decide which data may instruct, which data may only inform, and which actions require proof outside the model's interpretation.