Trust Boundaries in System Design: Privilege Models and Bypass Risks | EducationPals.ai