The boundary changes by product. The discipline does not.
Each product story now distinguishes privacy, sandboxing and capabilities, deterministic authority, and proof. WebAssembly is used where it genuinely narrows execution power—not as a decorative claim applied to every feature.
Prefer browser-local, same-origin, or offline processing; disclose only the approved evidence a remote service actually needs.
Use worker and WebAssembly containment, explicit imports, typed tools, deadlines, allowlists, and fail-closed defaults.
Keep identity, permissions, policy, approval, exact execution, verification, receipts, and replay outside probabilistic control.