The context is the attack surface
Your instructions, the user's question, a retrieved document and a tool result arrive as the same kind of thing. The model has no way to tell which of them you trusted, and it was never given one.
Not yet
This one opens once you have finished Memory and RAG.
Progress is kept against your account, so finishing a module needs one. Everything up to here is open without.