I have a few thoughts on this. * We have to use auth that belong to the user and not the LLM, or we have to use a combination of LLM and user keys. The LLM ca

I have a few thoughts on this. * We have to use auth that belong to the user and not the LLM, or we have to use a combination of LLM and user keys. The LLM cannot have global read/write access. * We could give each LLM limited access to APIs but have multiple LLMs. In this way we can control user access to API endpoints based on which LLM they have access to. * Any context building information we feed the LLM can probably be leaked so we shouldn't feed it any sensitive prompts. In fact we should assume any information we give the LLM can be leaked, so we should treat feeding an LLM data as the same security risk as feeding the user data.