A member of tenant red uploads an untrusted document. An isolated parser extracts text and proposes a title. A red reviewer previews the result; only a red publisher may release a reviewed version. The parser cannot access the network and has a per-job CPU, memory and output-size limit. Storage keeps immutable upload and extraction versions. The preview renders extracted content. Name the trust boundaries, two threats that remain after parser isolation, and negative and positive tests. A parser result must never grant publication authority.

Draw upload-to-parser, parser-to-stored-extraction, extraction-to-preview and reviewed-version-to-publication boundaries. Bind each extraction to the tenant, upload digest and parser version using trusted job metadata; document text cannot choose those values. Parser isolation limits execution damage but does not make its output safe to render or authoritative. A malicious output can alter the preview or mislead a reviewer; use safe text rendering or the explicitly allowed content policy. A review must bind the exact immutable extraction version or digest. If extraction v2 replaces v1 after review, v1's approval cannot authorize v2. Check the current publisher's permission separately from whether an artifact was reviewed. Per-job limits also do not bound thousands of concurrent jobs: apply tenant and global admission limits with cleanup and retry bounds.

Negative tests: Submit content that attempts active preview behavior and confirm that it cannot execute. Review extraction v1, then request publication of v2 and require a new review. Let a reviewer without publisher permission attempt publication and reject it. Exceed the permitted concurrent job count and verify bounded resource use and eventual cleanup. Positive tests: Parse a permitted document, safely preview it, approve its exact extraction version, and publish that version with a currently authorized red publisher. Verify that valid parsing and review do not silently confer publication permission.