> The moment you add smarts, you now need to analyse the possibility of injection via any column the tool is allowed to read from.

Viewed this way, you'd want to look at something like the cartesian product for {inputFields} x {llmPermissions}, no?

Idea being that limiting either constrains the potential exploitation space.