An email assistant has tools to read the inbox, send email, and edit the calendar. To resist injection, the team adopts a dual-LLM design. A privileged planner model issues tool calls but never sees raw email text. A quarantined model with no tool access processes the emails and returns its results as opaque variables, which the planner can only pass along. What is the primary tradeoff the team accepts?

1. A The planner never sees email contents, so tasks that depend on what an email says need user confirmation to act.
2. B The quarantined model's output becomes trusted, so it must pass an output classifier before the planner can read it.
3. C Injection is now impossible end to end, so the only real cost is roughly doubled inference spend per user request.
4. D All email must be sanitized before reaching the quarantined model, adding an extra parsing step to every message read.