L2-UC01: Input / Output Moderation

ALLOWED: Benign Health Benefits Query BLOCKED: Synthetic AWS Secret & Prompt Injection

L2-UC02: RAG Access & Retrieval Drift

ALLOWED: HR User Authorized RAG Query BLOCKED: Sales User Unauthorized Role Violation BLOCKED: Cross-User Memory/Cache Exfiltration BLOCKED: Unbaselined Retrieval Drift Violation

L2-UC03: Agent & MCP Tool Governance

ALLOWED: Approved Read-Only Tool Call BLOCKED: Prohibited Write Tool Call BLOCKED: Sensitive Data Egress Attempt BLOCKED: Unapproved Agent Purpose Shift