AI Product Builder exposes read-only planning and review tools. It cannot directly access a user's local filesystem, execute commands, deploy software, delete data, spend money, publish externally, or send communications. Its complete private source rules are never loaded into the host model. Phase policies are fetched server-side from a private repository, schema-validated, checksum-verified, and fail closed when unavailable or invalid.