Tool-calling LLM agents are vulnerable to indirect prompt injection: externally retrieved data can redirect tool calls without system-prompt access, and prompt-level defences leave three harm classes undefended (path traversal, user-guided exfiltration, high-frequency tool abuse). We present a Policy Enforcement Point (PEP) that intercepts at the tool-call boundary with declarative rules over a cross-step information-flow label system (source integrity, data sensitivity) and a synchronous SHA-256 hash-chained audit log. On a controlled dataset across four attack classes, the full system cuts the attack success rate (ASR) from 40.0% to 5.0% (deepseek-v4-pro, five repeats) versus 35.0% for the strongest prompt-only baseline; disabling cross-step label propagation raises the call-level false-negative rate by 26.4 points. The 30.0% task-level false-positive rate is dominated by by-design least-privilege capability-token denials, not rule false positives—an expanded 30-task benign set yields 0/30 rule false positives under scripted isolation. A conservative-DS mitigation (intent-taint) closes the constructed denied-read reconstruction blind-spot variant (ASR 100% to 0%) at no cost on standard workflows. The audit log detects all three tested tamper classes; the in-process enforcement overhead is sub-millisecond per call. Across four further backends, ASR drops under the full system, though LLaMA-3.3-70B retains 16.7% (a rule-coverage gap). A preliminary run over a real MCP stdio transport (an official filesystem server) shows the mechanism operates at a real boundary with a sub-millisecond execution-path increment. We frame these as mechanism-coverage evidence on a controlled benchmark, not a deployability claim for production MCP workloads. Code, data, and metrics are openly available in the replication repository.

As digital transformation accelerates outsourcing adoption in university libraries, concerns emerge regarding core capability erosion in reading promotion services, yet systematic understanding of optimal insourcing–outsourcing boundary choices remains limited. This study employs crisp-set Qualitative Comparative Analysis to examine 2399 reading promotion activities from 19 Shanghai universities over the past 5 years, analyzing configurational pathways across four capability dimensions: core collections, distinctive services, data elements, and library spaces. Results reveal asymmetric advantages between service models: insourcing pathways achieve effectiveness through physical space–staff synergy (CO1–CO3, consistency = 0.897–1.000), emphasizing face-to-face interactions and professional relationships, while outsourcing pathways leverage technology–expertise coupling (SO1–SO3, consistency = 0.860–1.000), integrating virtual platforms with external knowledge resources. No single capability proves necessary for success, confirming configurational causality in reading promotion effectiveness. These findings demonstrate that sustainable competitive advantage emerges from capability-specific boundary delineation rather than wholesale outsourcing strategies, providing theoretical insights for capability-based outsourcing decisions and practical guidance for dynamic resource allocation in library digital transformation contexts.

Purpose: This study aims to address the lack of a unified grading framework in Chinese reading by proposing a comprehensive model integrating linguistic complexity and reading experience, to evaluate the difficulty level of Chinese books. Design/methodology/approach: We utilized the Probabilistic Fuzzy Linguistic Technique (PFLT) for subjective indicators related to reading experience. Combined with collected objective indicators data, the Entropy Weight Method (EWM) is used for objective weight allocation, and Tomada De Decisão Interativa Multicritério (TODIM) is applied for multi-criteria decision-making. Findings: The results demonstrate that the proposed framework significantly enhances the alignment between text complexity and reader engagement, achieving a high consistency with authoritative benchmarks. Research limitations: The study may be limited by the scope of subjective and objective indicators used; further validation with more diverse data sources could strengthen generalizability. Practical implications: This approach shows promise in advancing the standardization and objectivity of Chinese reading grading systems, with potential applications in educational and publishing contexts. Originality/value: This study offers a structured evaluation model that incorporates both linguistic complexity and experiential factors, providing a novel and comprehensive method for assessing Chinese text difficulty.