Pass application data separately from model-generated source. This avoids
serializing sensitive or large tool results into the language channel and lets
the host update values without regenerating UI.
Binding roots
Bindings are values, not expressions. The allowlisted pure functions can
compare, compose booleans, select fallbacks, count or sum values, format values,
and choose responsive values; they cannot perform I/O or mutate state.
“Trusted data” means the host controls the channel, not that every value is
safe for every operation. Validate server/tool data before use, minimize
sensitive fields, and never turn bound strings into HTML, code, URLs, or
authorization decisions without the relevant policy check.
