One security concern I've been thinking about in n8n is how much trust we give to incoming data. Imagine a workflow receives a webhook from an external source, passes the payload to an AI agent, and allows that agent to use tools connected to the workflow. The problem is that the incoming payload isn't necessarily trustworthy. It could contain unexpected fields, malicious instructions, or values designed to trigger actions the workflow wasn't supposed to perform. Prompt instructions alone don't seem like a reliable security boundary. I'm curious how experienced n8n builders approach this: Do you isolate untrusted input before it reaches the agent, validate every tool parameter against a strict schema, or enforce permissions at the individual node level? I'd particularly like to understand how you prevent untrusted input from influencing actions outside the intended scope of a workflow.