ML_Systems_Type#Red teaming should cover the application around the model, not only adversarial prompts, because retrieved documents can contain instructions, tool outputs may carry untrusted text and authorization can fail between services. AI security evaluation should record the attempted path and the control that stopped it. That evidence distinguishes a resilient workflow from a model that merely refused one wording. Retest the path after changes to prompts, retrieval rules or tool permissions.