The trust boundary
Every route in this service wraps the customer’s message in <customer_message> tags and tells the model that the contents are data, not instructions. That is most of the defence and it is not the part that fails. The part that fails is that the customer can close the tag.
Toggle the escaping off and watch what the model actually receives. Then look at the second payload, where there is no markup to neutralize at all — that one is stopped by arithmetic instead, and the difference between those two kinds of defence is the whole subject of Lab 8.
Close the data block and open a forged system block that grants unlimited refund authority.
Escaping. Once every < becomes <, the payload cannot construct a tag at all — the only real tags in the block are the two we wrote.
Nothing here calls the API. The escaping is applied in your browser by the same rule the service uses, so the structural half of the defence is shown with full fidelity. For the behavioural half you need a model: the live playground on the storefront really classifies, defences on or off.
Build the controls yourself in Lab 8.