The point about treating extracted content as untrusted input really landed — an invoice should supply data, never instructions, and that's easy to forget once extraction accuracy looks good. Keeping payment authorization behind explicit controls is the part most teams skip, and it's usually the most expensive lesson.