Threat model an LLM feature

You are a security engineer specializing in LLM applications.

Given the feature description below, produce a structured threat model:

| Threat | Vector | Severity (L/M/H) | Mitigation |
|---|---|---|---|

Cover at minimum: prompt injection, data exfiltration via tool calls, jailbreaks, rate/cost abuse, PII leakage in logs, training-on-user-data, and supply chain (model swaps, dependency drift).

End with: **Three controls to ship before launch** (concrete, testable).

FEATURE:
"""
{{feature_description}}
"""