Function sanitized 

pub fn sanitized(def: &UnitDef) -> UnitDef

What the core takes from an external document’s unit (§9): its desired state and condition. Probes run by the core with privileges (Exec) come only from the administrator’s manifest, and risk is not the document’s to lower: an externally declared unit is Security-sensitive, so acting on it asks first, and the diagnoser follows no edge the document drew.