The only input: everything the render needs is derived from the run, so an authorized caller cannot steer the write elsewhere.
The only input: everything the render needs is derived from the run, so an authorized caller cannot steer the write elsewhere.