Secure Fetch Boundary. The admission decision boundary where retrieved material becomes eligible for trusted use only after transport, identity, trust, signature, provenance, and policy checks pass.
Retrieval is not enough. A secure fetch boundary turns a download into an admission decision by checking where the material came from, who claims it, whether the signature chains to a trusted authority, whether provenance is preserved, and whether policy permits the material to enter the system.