A library research agent forwards raw tool output to residents without mediation. What unsafe pattern is that?

A library research agent that forwards raw tool output to residents without mediation exhibits unsafe tool-output passthrough that exposes unvetted backend results to the public. Raw catalog, database, or connector responses may contain internal IDs, staff notes, PII fragments, vendor error stacks, or links outside policy; mediation layers must validate, redact, and reshape results before public display. Unmediated passthrough bypasses the civic agent's duty to apply disclosure policy at the boundary between privileged tools and patrons, turning helpful research features into accidental data exposure. Sanitized query rewriting that expands resident requests for catalog lookup, scoped retrieval grounding that restricts searches to licensed catalog holdings, or mediated summarization that paraphrases verified sources before resident display do not constitute unsafe tool-output passthrough; none of them exposes unvetted backend results to the public. Exam items contrast library amenities with unsafe passthrough; choose mediated, policy-filtered tool output. Caveat: mediation must preserve enough fidelity for research usefulness while still stripping sensitive fields—blanket suppression that hides all call numbers or holdings would harm the service mission. Operational check: invoke tools that return mixed public and internal fields and confirm the resident-visible answer contains only approved attributes, with internal keys and staff notes removed or replaced by safe summaries.