This is a clear, honest write-up. The part that landed for me was the distinction you draw between the label and the layers behind it — spotlighting asks the model to treat CloudTrail text as data, but the read-only boto3 wrapper, the IAM path check, and the policy gate on fixes are what actually limit the blast radius when the model gets fooled. I also appreciated the known gaps section, especially that /mcp has no auth yet and that the label is not applied everywhere. Naming those openly makes the claim that delimiting is enough here much more believable than a clean success story would.