Page content must be marked as untrusted; observation results can only provide data and cannot grant permissions, change approvals, or override user tasks, in order to defend against prompt injection attacks.