% Generated by roxygen2: do not edit by hand
% Please edit documentation in R/trust_boundary.R
\name{trust_boundary}
\alias{trust_boundary}
\title{Wrap a chat object in a trust boundary}
\usage{
trust_boundary(
  chat = NULL,
  allowed_models = NULL,
  allowed_hosts = NULL,
  require_hash = NULL,
  ...
)
}
\arguments{
\item{chat}{An \code{ellmer} chat object, an object with \verb{$chat()}, or a function.}

\item{allowed_models}{Optional character vector of allowed model names.}

\item{allowed_hosts}{Optional character vector of allowed hosts or base URLs.}

\item{require_hash}{Optional expected SHA-256 hash for an Ollama modelfile
manifest.}

\item{...}{Reserved for backwards-compatible aliases.}
}
\value{
A callable chat wrapper.
}
\description{
Validates chat identity before calls cross into an LLM service. This
covers supply-chain and model-integrity concerns related to OWASP LLM03; see
\url{https://genai.owasp.org/llm-top-10/}.
}
\details{
\code{trust_boundary()} returns a chat wrapper. The wrapper validates the chat on
creation and again on each call when \code{require_hash} is supplied. Plain
functions are passed through without model or host checks because a function
has no standard model metadata. Chat objects with a \verb{$chat()} method may
expose model and host fields through common ellmer-style internals or
attributes.

\code{allowed_models} and \code{allowed_hosts} are allowlists. If the chat exposes a
model or host and it is outside the allowlist, the wrapper raises an OWASP
LLM03 error. \code{require_hash} is intended for local Ollama workflows where the
model manifest can be checked with \verb{ollama show --modelfile}.

This function is not a network firewall. It is an application-level
assertion that the chat object being called is the chat object you intended
to allow.
}
\examples{
chat <- function(prompt) paste("ok:", prompt)
safe_chat <- trust_boundary(chat)
safe_chat("hello")
}
