Adding a trust boundary to an AutoGen AgentChat workflow

AutoGen-style workflows usually look harmless at the message level. One agent reads something. Another agent replies. A third agent decides what to do next. The problem starts when the first thing was not trusted. Maybe it was a support ticket. Maybe a PDF. Maybe a web page. Maybe an email thread. The first agent reads it, produces a clean summary, and that summary moves into the next agent step. After one or two turns, the original source is no longer visible. What remains is just another agent