All calls to LLM service take place on the server. Prompts are more or less predefined by an internal team. Users click useful buttons that alters functions to sanitized JSON. Users cannot free-form requests. This is how we’re starting anyway. B2B SaaS startup.