Introduces security-model guidance covering provider invariants, expected auth failure modes, and integration-safe handling.