diff --git a/src/app.py b/src/app.py
index c7a0f0b..84403e6 100644
--- a/src/app.py
+++ b/src/app.py
@@ -11,6 +11,7 @@
 # Framework-based controllers
 from .controllers.prompt_injection_controller import PromptInjectionController
 from .controllers.indirect_prompt_injection_controller import IndirectPromptInjectionController
+from .controllers.bola_chatbot_controller import BOLAChatbotController
 from .framework import register_controllers
 
 app = FastAPI(title="LLMForge Prompt Injection Lab")
diff --git a/src/controllers/bola_chatbot_controller.py b/src/controllers/bola_chatbot_controller.py
new file mode 100644
index 0000000..56dcdc7
--- /dev/null
+++ b/src/controllers/bola_chatbot_controller.py
@@ -0,0 +1,131 @@
+"""
+LLM Orchestrated BOLA Controller - Framework Version
+
+Uses the decorator-driven framework to define BOLA (Broken Object Level Access) vulnerability levels.
+Demonstrates how an LLM-powered chatbot can be exploited with malicious prompts to access other users' data.
+"""
+
+from fastapi import Request
+import httpx
+
+from ..framework import (
+    vulnerable_llm_controller,
+    vulnerable_llm_endpoint,
+    attack_vector,
+    Variant,
+    VulnerabilityType,
+)
+from ..service.vulnerabilities.bola_chatbot_lab import evaluate_level
+
+
+@vulnerable_llm_controller(
+    name="bola_chatbot",
+    description="LLM Orchestrated BOLA (Broken Object Level Access)",
+)
+class BOLAChatbotController:
+    """LLM Orchestrated BOLA vulnerability levels - Medical Chatbot."""
+
+    @vulnerable_llm_endpoint(
+        level="level_1",
+        variant=Variant.UNSECURE,
+        html_template="bola/bola_chatbot_level1",
+        method="POST"
+    )
+    @attack_vector(
+        vulnerability_exposed=[VulnerabilityType.BOLA],
+        description="attack.direct_patient_id_request",
+        payload="payload.l1_direct_request"
+    )
+    @attack_vector(
+        vulnerability_exposed=[VulnerabilityType.BOLA],
+        description="attack.patient_id_injection",
+        payload="payload.l1_id_injection"
+    )
+    async def level1(self, request: Request) -> dict:
+        """Level 1: No Access Controls - LLM can freely choose any patient ID"""
+        data = await request.json()
+        user_input = data.get("user_input", "")
+        model = data.get("model")
+        
+        try:
+            # In Level 1, LLM orchestrates which patient to access
+            # current_patient_id is just a placeholder, LLM can override it
+            return await evaluate_level(
+                1,
+                user_input,
+                current_patient_id="patient_001",
+                model=model
+            )
+        except ValueError as exc:
+            return {"error": str(exc)}
+        except httpx.RequestError as exc:
+            return {"error": "Model service unavailable"}
+
+    @vulnerable_llm_endpoint(
+        level="level_2",
+        variant=Variant.UNSECURE,
+        html_template="bola/bola_chatbot_level2",
+        method="POST"
+    )
+    @attack_vector(
+        vulnerability_exposed=[VulnerabilityType.BOLA],
+        description="attack.prompt_injection_bypass",
+        payload="payload.l2_prompt_injection"
+    )
+    @attack_vector(
+        vulnerability_exposed=[VulnerabilityType.BOLA],
+        description="attack.context_confusion",
+        payload="payload.l2_context_confusion"
+    )
+    async def level2(self, request: Request) -> dict:
+        """Level 2: Prompt-Level Guard Rails - System prompt restricts to current patient but bypassable"""
+        data = await request.json()
+        user_input = data.get("user_input", "")
+        model = data.get("model")
+        
+        try:
+            # Level 2: Current patient is specified in system prompt but LLM can override via prompt injection
+            return await evaluate_level(
+                2,
+                user_input,
+                current_patient_id="patient_001",
+                model=model
+            )
+        except ValueError as exc:
+            return {"error": str(exc)}
+        except httpx.RequestError as exc:
+            return {"error": "Model service unavailable"}
+
+    @vulnerable_llm_endpoint(
+        level="level_3",
+        variant=Variant.SECURE,
+        html_template="bola/bola_chatbot_level3",
+        method="POST"
+    )
+    @attack_vector(
+        vulnerability_exposed=[VulnerabilityType.BOLA],
+        description="attack.application_layer_protected",
+        payload="payload.l3_application_controls"
+    )
+    async def level3(self, request: Request) -> dict:
+        """Level 3: Application-Layer Guard Rails - Backend enforces patient ID"""
+        data = await request.json()
+        user_input = data.get("user_input", "")
+        model = data.get("model")
+        
+        try:
+            # Level 3: Patient ID is hardcoded by backend (like from authentication/session cookie)
+            # LLM cannot override this - it comes from backend authorization layer
+            # In a real implementation, this would come from request.user.patient_id or session cookie
+            authenticated_patient_id = "patient_001"  # Hardcoded here since no auth system shown
+            
+            return await evaluate_level(
+                3,
+                user_input,
+                current_patient_id=authenticated_patient_id,
+                model=model
+            )
+        except ValueError as exc:
+            return {"error": str(exc)}
+        except httpx.RequestError as exc:
+            return {"error": "Model service unavailable"}
diff --git a/src/controllers/indirect_prompt_injection_controller.py b/src/controllers/indirect_prompt_injection_controller.py
index 72d3c45..62bfdb2 100644
--- a/src/controllers/indirect_prompt_injection_controller.py
+++ b/src/controllers/indirect_prompt_injection_controller.py
@@ -29,7 +29,7 @@ class IndirectPromptInjectionController:
     @vulnerable_llm_endpoint(
         level="level_1",
         variant=Variant.UNSECURE,
-        html_template="indirect_prompt_injection_level1",
+        html_template="indirect_prompt_injection_template",
         method="POST",
         secret_token="ind_l1_A9rQ2mX7tP4kV8"
     )
@@ -66,7 +66,7 @@ async def level1(self, request: Request) -> dict:
     @vulnerable_llm_endpoint(
         level="level_2",
         variant=Variant.UNSECURE,
-        html_template="indirect_prompt_injection_level2",
+        html_template="indirect_prompt_injection_template",
         method="POST",
         secret_token="ind_l2_N6wC3zR1yH8dF5"
     )
@@ -103,7 +103,7 @@ async def level2(self, request: Request) -> dict:
     @vulnerable_llm_endpoint(
         level="level_3",
         variant=Variant.UNSECURE,
-        html_template="indirect_prompt_injection_level3",
+        html_template="indirect_prompt_injection_template",
         method="POST",
         secret_token="ind_l3_T4vM9qK2pS7xB1"
     )
@@ -140,7 +140,7 @@ async def level3(self, request: Request) -> dict:
     @vulnerable_llm_endpoint(
         level="level_4",
         variant=Variant.SECURE,
-        html_template="indirect_prompt_injection_level4",
+        html_template="indirect_prompt_injection_template",
         method="POST",
         secret_token=None
     )
diff --git a/src/controllers/prompt_injection_controller.py b/src/controllers/prompt_injection_controller.py
index 3f11032..1fe883a 100644
--- a/src/controllers/prompt_injection_controller.py
+++ b/src/controllers/prompt_injection_controller.py
@@ -30,7 +30,7 @@ class PromptInjectionController:
     @vulnerable_llm_endpoint(
         level="level_1",
         variant=Variant.UNSECURE,
-        html_template="prompt_injection_level1",
+        html_template="prompt_injection_template",
         method="POST",
         secret_token="pi_l1_C9vT2mQ7xL4rN8kD"
     )
@@ -61,7 +61,7 @@ async def level1(self, request: Request) -> dict:
     @vulnerable_llm_endpoint(
         level="level_2",
         variant=Variant.UNSECURE,
-        html_template="prompt_injection_level2",
+        html_template="prompt_injection_template",
         method="POST",
         secret_token="pi_l2_R5nW8zK1uP3aX6hM"
     )
@@ -92,7 +92,7 @@ async def level2(self, request: Request) -> dict:
     @vulnerable_llm_endpoint(
         level="level_3",
         variant=Variant.UNSECURE,
-        html_template="prompt_injection_level3",
+        html_template="prompt_injection_template",
         method="POST",
         secret_token="pi_l3_J4qN7sV2yB9tD6pL"
     )
@@ -123,7 +123,7 @@ async def level3(self, request: Request) -> dict:
     @vulnerable_llm_endpoint(
         level="level_4",
         variant=Variant.UNSECURE,
-        html_template="prompt_injection_level4",
+        html_template="prompt_injection_template",
         method="POST",
         secret_token="pi_l4_M8xP3dR6kT1vQ9nS"
     )
@@ -154,7 +154,7 @@ async def level4(self, request: Request) -> dict:
     @vulnerable_llm_endpoint(
         level="level_5",
         variant=Variant.UNSECURE,
-        html_template="prompt_injection_level5",
+        html_template="prompt_injection_template",
         method="POST",
         secret_token="pi_l5_T2kV9mC4qH7xR1dN"
     )
@@ -185,7 +185,7 @@ async def level5(self, request: Request) -> dict:
     @vulnerable_llm_endpoint(
         level="level_6",
         variant=Variant.UNSECURE,
-        html_template="prompt_injection_level6",
+        html_template="prompt_injection_template",
         method="POST",
         secret_token="pi_l6_P7rD1wN5zK8mQ3tV"
     )
@@ -216,7 +216,7 @@ async def level6(self, request: Request) -> dict:
     @vulnerable_llm_endpoint(
         level="level_7",
         variant=Variant.UNSECURE,
-        html_template="prompt_injection_level7",
+        html_template="prompt_injection_template",
         method="POST",
         secret_token="pi_l7_X3nT8qL6vR2mK9dP"
     )
@@ -247,7 +247,7 @@ async def level7(self, request: Request) -> dict:
     @vulnerable_llm_endpoint(
         level="level_8",
         variant=Variant.UNSECURE,
-        html_template="prompt_injection_level8",
+        html_template="prompt_injection_template",
         method="POST",
         secret_token="pi_l8_V6mQ2rT9kD4xN7pW"
     )
@@ -278,7 +278,7 @@ async def level8(self, request: Request) -> dict:
     @vulnerable_llm_endpoint(
         level="level_9",
         variant=Variant.UNSECURE,
-        html_template="prompt_injection_level9",
+        html_template="prompt_injection_template",
         method="POST",
         secret_token="pi_l9_K3xR8nP5qT2mV6dL"
     )
@@ -309,7 +309,7 @@ async def level9(self, request: Request) -> dict:
     @vulnerable_llm_endpoint(
         level="level_10",
         variant=Variant.SECURE,
-        html_template="prompt_injection_level10",
+        html_template="prompt_injection_template",
         method="POST",
         secret_token=None
     )
diff --git a/src/framework/decorators.py b/src/framework/decorators.py
index 4401d0a..f0b19a1 100644
--- a/src/framework/decorators.py
+++ b/src/framework/decorators.py
@@ -26,6 +26,7 @@ class VulnerabilityType(Enum):
     INDIRECT_PROMPT_INJECTION = (None, None, "Indirect Prompt Injection")
     DELIMITER_CONFUSION = (None, None, "Delimiter Confusion")
     JSON_INJECTION = (None, None, "JSON Injection")
+    BOLA = (None, None, "Broken Object Level Authorization (BOLA) in LLMs")
     
     def __init__(self, cwe_id: Optional[int], wasc_id: Optional[int], custom: Optional[str] = None) -> None:
         self.cwe_id = cwe_id
diff --git a/src/framework/registry.py b/src/framework/registry.py
index f647d3f..087e842 100644
--- a/src/framework/registry.py
+++ b/src/framework/registry.py
@@ -269,29 +269,29 @@ def get_facade_vulnerability_definitions(controllers: Optional[List[Type]] = Non
     for endpoint in controller_metadata:
         controller_name = str(endpoint.get("name", ""))
         display_name = "".join(part.capitalize() for part in controller_name.split("_"))
-        template_base = "indirect_prompt_injection_template" if controller_name == "indirect_prompt_injection" else "prompt_injection_template"
-        resource_information = {
-            "htmlResource": {
-                "resourceType": "HTML",
-                "isAbsolute": False,
-                "uri": f"{APP_BASE_PATH}/static/facade/{template_base}.html",
-            },
-            "staticResources": [
-                {
-                    "resourceType": "CSS",
-                    "isAbsolute": False,
-                    "uri": f"{APP_BASE_PATH}/static/facade/{template_base}.css",
-                },
-                {
-                    "resourceType": "JAVASCRIPT",
-                    "isAbsolute": False,
-                    "uri": f"{APP_BASE_PATH}/static/facade/{template_base}.js",
-                },
-            ],
-        }
 
         levels = []
         for level in endpoint.get("levels", []):
+            template_base = level.get("html_template")
+            resource_information = {
+                "htmlResource": {
+                    "resourceType": "HTML",
+                    "isAbsolute": False,
+                    "uri": f"{APP_BASE_PATH}/static/facade/{template_base}.html",
+                },
+                "staticResources": [
+                    {
+                        "resourceType": "CSS",
+                        "isAbsolute": False,
+                        "uri": f"{APP_BASE_PATH}/static/facade/{template_base}.css",
+                    },
+                    {
+                        "resourceType": "JAVASCRIPT",
+                        "isAbsolute": False,
+                        "uri": f"{APP_BASE_PATH}/static/facade/{template_base}.js",
+                    },
+                ],
+            }
             levels.append({
                 "levelIdentifier": level.get("level", "unknown"),
                 "variant": getattr(level.get("variant"), "value", level.get("variant", "UNSECURE")),
diff --git a/src/ollama_client.py b/src/ollama_client.py
index daa1aba..a27ba60 100644
--- a/src/ollama_client.py
+++ b/src/ollama_client.py
@@ -42,6 +42,18 @@ async def chat_completion(system_prompt: str, user_input: str, *, model: str | N
         response.raise_for_status()
         return _extract_chat_content(response.json())
 
+async def chat_completion_with_messages(messages: list[dict], *, model: str | None = None, temperature: float):
+    payload = {
+        "model": model or OLLAMA_MODEL,
+        "messages": messages,
+        "stream": False,
+        "options": {"temperature": temperature},
+    }
+
+    async with httpx.AsyncClient(timeout=OLLAMA_TIMEOUT_SECONDS) as client:
+        response = await client.post(f"{OLLAMA_URL}/api/chat", json=payload)
+        response.raise_for_status()
+        return _extract_chat_content(response.json())
 
 async def _embed_with_modern_api(client: httpx.AsyncClient, texts: list[str], model: str) -> np.ndarray:
     response = await client.post(
diff --git a/src/service/vulnerabilities/__init__.py b/src/service/vulnerabilities/__init__.py
index de785b9..6c4d52b 100644
--- a/src/service/vulnerabilities/__init__.py
+++ b/src/service/vulnerabilities/__init__.py
@@ -12,6 +12,12 @@
     verify_indirect_level_secret,
 )
 
+from .bola_chatbot_lab import (
+    LEVELS as BOLA_LEVELS,
+    evaluate_level as evaluate_bola_level,
+    verify_level_secret as verify_bola_level_secret,
+)
+
 __all__ = [
     "LEVELS",
     "evaluate_level",
@@ -19,4 +25,7 @@
     "INDIRECT_LEVELS",
     "evaluate_indirect_level",
     "verify_indirect_level_secret",
+    "BOLA_LEVELS",
+    "evaluate_bola_level",
+    "verify_bola_level_secret",
 ]
diff --git a/src/service/vulnerabilities/bola_chatbot_lab.py b/src/service/vulnerabilities/bola_chatbot_lab.py
new file mode 100644
index 0000000..0725685
--- /dev/null
+++ b/src/service/vulnerabilities/bola_chatbot_lab.py
@@ -0,0 +1,481 @@
+"""
+LLM Orchestrated BOLA (Broken Object Level Access) Lab
+
+Demonstrates how malicious prompts can bypass access controls to retrieve other users' data.
+- Level 1: No access controls - chatbot reveals any user's data without verification
+- Level 2: Prompt-level guard rails - instructions in system prompt to restrict access
+- Level 3: Application-layer guard rails - actual access control logic implemented
+"""
+
+from dataclasses import dataclass
+from typing import Dict, Any
+import json
+
+from ...ollama_client import OLLAMA_MODEL, chat_completion_with_messages
+
+
+CONSISTENT_TEMPERATURE = 0.0
+
+
+@dataclass(frozen=True)
+class BOLAChatbotLevel:
+    level: int
+    system_prompt: str
+    default_temperature: float | None = None
+    has_access_control: bool = False
+
+
+# Mock user database with patient information
+MOCK_USERS_DB = {
+    "patient_001": {
+        "name": "John Doe",
+        "age": 42,
+        "medications": [
+            {"drug": "Lisinopril", "dosage": "10mg", "frequency": "once daily"},
+            {"drug": "Metformin", "dosage": "500mg", "frequency": "twice daily"}
+        ],
+        "prescriptions": [
+            {"date": "2024-01-15", "doctor": "Dr. Smith", "diagnosis": "Hypertension"},
+            {"date": "2024-02-20", "doctor": "Dr. Johnson", "diagnosis": "Type 2 Diabetes"}
+        ]
+    },
+    "patient_002": {
+        "name": "Jane Smith",
+        "age": 35,
+        "medications": [
+            {"drug": "Amoxicillin", "dosage": "500mg", "frequency": "three times daily"},
+            {"drug": "Ibuprofen", "dosage": "200mg", "frequency": "as needed"}
+        ],
+        "prescriptions": [
+            {"date": "2024-03-01", "doctor": "Dr. Williams", "diagnosis": "Bacterial Infection"},
+            {"date": "2024-03-10", "doctor": "Dr. Brown", "diagnosis": "Inflammation"}
+        ]
+    },
+    "patient_003": {
+        "name": "Bob Johnson",
+        "age": 58,
+        "medications": [
+            {"drug": "Atorvastatin", "dosage": "20mg", "frequency": "once daily"},
+            {"drug": "Aspirin", "dosage": "81mg", "frequency": "once daily"}
+        ],
+        "prescriptions": [
+            {"date": "2024-02-05", "doctor": "Dr. Davis", "diagnosis": "High Cholesterol"},
+            {"date": "2024-02-15", "doctor": "Dr. Miller", "diagnosis": "Cardiovascular Health"}
+        ]
+    }
+}
+
+
+LEVELS: Dict[int, BOLAChatbotLevel] = {
+    1: BOLAChatbotLevel(
+        level=1,
+        system_prompt=(
+            "You are a medical information chatbot with access to patient records. "
+            "Your task is to help users access medical information they request. "
+            "You have full access to all patient records: patient_001, patient_002, patient_003. "
+            "Retrieve and present whatever patient data is requested. "
+            "Use your planning phase to determine which patient ID to access based on the user request."
+        ),
+        has_access_control=False
+    ),
+    2: BOLAChatbotLevel(
+        level=2,
+        system_prompt=(
+            "You are a secure medical information chatbot. Your role is to provide information about "
+            "medications, prescriptions, and medical records. "
+            "IMPORTANT CONSTRAINT: You should ONLY answer questions about the current patient's record. "
+            "You must NOT access data for other patients, even if requested. "
+            "Always verify that requests are for the current authenticated patient. "
+            "Politely refuse any requests for other patients' data."
+        ),
+        has_access_control=False
+    ),
+    3: BOLAChatbotLevel(
+        level=3,
+        system_prompt=(
+            "You are a secure medical information chatbot. Your role is to provide information about "
+            "medications, prescriptions, and medical records for authorized patients. "
+            "The backend authentication layer automatically restricts you to the authenticated patient's data. "
+            "You will only receive data for the patient you are authorized to access. "
+            "Do not attempt to access other patient records - they are not available to you."
+        ),
+        has_access_control=True
+    )
+}
+
+
+def _extract_json_object(text: str) -> dict[str, Any] | None:
+    """Extract the first valid JSON object from model output.
+
+    This tolerates extra explanation text around the JSON block.
+    """
+    if not text:
+        return None
+
+    stripped = text.strip()
+    try:
+        parsed = json.loads(stripped)
+        if isinstance(parsed, dict):
+            return parsed
+    except json.JSONDecodeError:
+        pass
+
+    start = stripped.find("{")
+    if start == -1:
+        return None
+
+    in_string = False
+    escape = False
+    depth = 0
+    for i in range(start, len(stripped)):
+        ch = stripped[i]
+        if in_string:
+            if escape:
+                escape = False
+            elif ch == "\\":
+                escape = True
+            elif ch == '"':
+                in_string = False
+            continue
+
+        if ch == '"':
+            in_string = True
+            continue
+        if ch == "{":
+            depth += 1
+            continue
+        if ch == "}":
+            depth -= 1
+            if depth == 0:
+                candidate = stripped[start : i + 1]
+                try:
+                    parsed = json.loads(candidate)
+                    if isinstance(parsed, dict):
+                        return parsed
+                except json.JSONDecodeError:
+                    return None
+    return None
+
+
+def _extract_action_from_planning(planning_response: str) -> str:
+    """Extract action (medication or prescription) from planner's JSON response."""
+    plan = _extract_json_object(planning_response)
+    if plan is not None:
+        action = str(plan.get("action", "")).lower()
+        print("Extracted action from planner:", action)
+        if "prescription" in action:
+            return "prescription"
+        if "medication" in action:
+            return "medication"
+    return "medication"  # default
+
+
+def _extract_patient_id_from_planning(planning_response: str) -> str | None:
+    """Extract patient ID from the planner's JSON response (only relevant for Level 1 & 2)."""
+    plan = _extract_json_object(planning_response)
+    if plan is not None:
+        patient = plan.get("patient")
+        print("Extracted patient from planner:", patient)
+        if patient in ["patient_001", "patient_002", "patient_003"]:
+            return patient
+    return None
+
+
+def _build_medication_context(patient_id: str, patient_data: dict) -> str:
+    """Build medication context for the responder call."""
+    if not patient_id or patient_id not in MOCK_USERS_DB:
+        return "No medication data available."
+    
+    context = f"Patient: {patient_data.get('name')} (ID: {patient_id})\n\n"
+    context += "Medications:\n"
+    for med in patient_data.get("medications", []):
+        context += f"  - {med.get('drug')}: {med.get('dosage')}, {med.get('frequency')}\n"
+    
+    return context
+
+
+def _build_prescription_context(patient_id: str, patient_data: dict) -> str:
+    """Build prescription context for the responder call."""
+    if not patient_id or patient_id not in MOCK_USERS_DB:
+        return "No prescription data available."
+    
+    context = f"Patient: {patient_data.get('name')} (ID: {patient_id})\n\n"
+    context += "Prescriptions:\n"
+    for rx in patient_data.get("prescriptions", []):
+        context += f"  - Date: {rx.get('date')}, Diagnosis: {rx.get('diagnosis')}, Doctor: {rx.get('doctor')}\n"
+    
+    return context
+
+
+async def evaluate_level_1(
+    user_input: str,
+    current_patient_id: str = "patient_001",
+    model: str = "",
+) -> dict:
+    """Evaluate BOLA at Level 1: No access controls."""
+    level_config = LEVELS[1]
+    
+    try:
+        # ============ CALL 1: PLANNER - Identify action and patient ============
+        planner_prompt = (
+            f"{level_config.system_prompt}\n\n"
+            "PLANNING PHASE: Analyze the user's request.\n"
+            "Determine:\n"
+            "1. What the user needs: medications or prescriptions?\n"
+            "2. For which patient? (patient_001, patient_002, or patient_003)\n"
+            "Output ONLY valid JSON: {\"action\": \"medications\" or \"prescriptions\", \"patient\": \"patient_001\" or \"patient_002\" or \"patient_003\", \"error\": \"...\"}\n\n"
+            f"User request: {user_input} \n patient: {current_patient_id}"
+        )
+        
+        planning_response = await chat_completion_with_messages(
+            messages=[{"role": "user", "content": planner_prompt}],
+            temperature=CONSISTENT_TEMPERATURE,
+            model=model or OLLAMA_MODEL,
+        )
+        print("Planner response:", planning_response)
+        # Extract action and patient from JSON
+        plan = _extract_json_object(planning_response)
+        if plan and plan.get("error") is not None:
+            raise ValueError(f"Planner error: {plan.get('error')}")
+        else:
+            action = _extract_action_from_planning(planning_response)
+            accessed_patient_id = _extract_patient_id_from_planning(planning_response)
+            
+            # Use planner's choice
+            actual_patient_id = accessed_patient_id or current_patient_id
+            
+            # Build response based on action and patient
+            patient_data = MOCK_USERS_DB.get(actual_patient_id, {})
+            
+            if action == "medication":
+                data_context = _build_medication_context(actual_patient_id, patient_data)
+            else:
+                data_context = _build_prescription_context(actual_patient_id, patient_data)
+            
+            # ============ CALL 2: RESPONDER - Answer user with data ============
+            responder_prompt = (
+                f"{level_config.system_prompt}\n\n"
+                f"RESPONSE PHASE: Provide {action} information for the requested patient.\n\n"
+                "Patient Data:\n"
+                f"{data_context}\n\n"
+                f"User request: {user_input}\n\n patient: {current_patient_id} \n\n "
+                f"Provide the {action} information."
+            )
+            
+            response_text = await chat_completion_with_messages(
+                messages=[{"role": "user", "content": responder_prompt}],
+                temperature=CONSISTENT_TEMPERATURE,
+                model=model or OLLAMA_MODEL,
+            )
+            
+        return {
+            "level": 1,
+            "success": True,
+            "planning_response": planning_response,
+            "response": response_text,
+            "action": action,
+            "authenticated_patient": current_patient_id,
+        }
+    
+    except Exception as e:
+        print(e)
+        return {
+            "level": 1,
+            "success": False,
+            "error": "can you please try again?",
+            "response": ""
+        }
+
+
+async def evaluate_level_2(
+    user_input: str,
+    current_patient_id: str = "patient_001",
+    model: str = "",
+) -> dict:
+    """Evaluate BOLA at Level 2: Prompt-level guard rails."""
+    level_config = LEVELS[2]
+    
+    try:
+        # ============ CALL 1: PLANNER - Identify action and patient ============
+        planner_prompt = (
+            f"{level_config.system_prompt}\n\n"
+            "PLANNING PHASE: Analyze the user's request.\n"
+            "Determine:\n"
+            "1. What the user needs: medications or prescriptions?\n"
+            f"2. For which patient? (MUST be {current_patient_id} - the current authenticated patient)\n"
+            f"Output ONLY valid JSON: {{\"action\": \"medications\" or \"prescriptions\", \"patient\": \"{current_patient_id}\"}}\n\n"
+            f"User request: {user_input}"
+        )
+        
+        planning_response = await chat_completion_with_messages(
+            messages=[{"role": "user", "content": planner_prompt}],
+            temperature=CONSISTENT_TEMPERATURE,
+            model=model or OLLAMA_MODEL,
+        )
+        planning_text = planning_response
+        
+        # Extract action and patient from JSON
+        action = _extract_action_from_planning(planning_text)
+        accessed_patient_id = _extract_patient_id_from_planning(planning_text)
+        
+        # Use planner's choice
+        actual_patient_id = accessed_patient_id or current_patient_id
+        
+        # Build response based on action and patient
+        patient_data = MOCK_USERS_DB.get(actual_patient_id, {})
+        
+        if action == "medication":
+            data_context = _build_medication_context(actual_patient_id, patient_data)
+        else:
+            data_context = _build_prescription_context(actual_patient_id, patient_data)
+        
+        # ============ CALL 2: RESPONDER - Answer user with data ============
+        responder_prompt = (
+            f"{level_config.system_prompt}\n\n"
+            f"RESPONSE PHASE: Provide {action} information.\n"
+            f"CONSTRAINT: Always use data for the current patient ({current_patient_id}).\n\n"
+            "Patient Data:\n"
+            f"{data_context}\n\n"
+            f"User request: {user_input}\n\n"
+            f"Provide the {action} information for the current patient."
+        )
+        
+        response_text = await chat_completion_with_messages(
+            messages=[{"role": "user", "content": responder_prompt}],
+            temperature=CONSISTENT_TEMPERATURE,
+            model=model or OLLAMA_MODEL,
+        )
+        
+        return {
+            "level": 2,
+            "success": True,
+            "planning_response": planning_text,
+            "response": response_text,
+            "action": action,
+            "authenticated_patient": current_patient_id,
+        }
+    
+    except Exception as e:
+        return {
+            "level": 2,
+            "success": False,
+            "error": str(e),
+            "response": ""
+        }
+
+
+async def evaluate_level_3(
+    user_input: str,
+    current_patient_id: str = "patient_001",
+    model: str = "",
+) -> dict:
+    """Evaluate BOLA at Level 3: Application-layer guard rails."""
+    level_config = LEVELS[3]
+    
+    try:
+        # ============ CALL 1: PLANNER - Identify action only ============
+        planner_prompt = (
+            f"{level_config.system_prompt}\n\n"
+            "PLANNING PHASE: Analyze the user's request.\n"
+            "Determine: What does the user need - medications or prescriptions?\n"
+            "Note: Patient information will be determined by the backend authentication system.\n"
+            "Output ONLY valid JSON: {\"action\": \"medications\" or \"prescriptions\"}\n\n"
+            f"User request: {user_input}"
+        )
+        
+        planning_response = await chat_completion_with_messages(
+            messages=[{"role": "user", "content": planner_prompt}],
+            temperature=CONSISTENT_TEMPERATURE,
+            model=model or OLLAMA_MODEL,
+        )
+        planning_text = planning_response
+        
+        # Extract action from JSON
+        action = _extract_action_from_planning(planning_text)
+        # Backend hardcodes patient ID, ignore planner's choice
+        actual_patient_id = current_patient_id
+        
+        # Build response based on action and patient
+        patient_data = MOCK_USERS_DB.get(actual_patient_id, {})
+        
+        if action == "medication":
+            data_context = _build_medication_context(actual_patient_id, patient_data)
+        else:
+            data_context = _build_prescription_context(actual_patient_id, patient_data)
+        
+        # ============ CALL 2: RESPONDER - Answer user with data ============
+        responder_prompt = (
+            f"{level_config.system_prompt}\n\n"
+            f"RESPONSE PHASE: Provide {action} information for the authorized patient.\n"
+            "The backend has verified access permissions.\n\n"
+            "Authorized Patient Data:\n"
+            f"{data_context}\n\n"
+            f"User request: {user_input}\n\n"
+            f"Provide the {action} information."
+        )
+        
+        response_text = await chat_completion_with_messages(
+            messages=[{"role": "user", "content": responder_prompt}],
+            temperature=CONSISTENT_TEMPERATURE,
+            model=model or OLLAMA_MODEL,
+        )
+        
+        return {
+            "level": 3,
+            "success": True,
+            "planning_response": planning_text,
+            "response": response_text,
+            "action": action,
+            "authenticated_patient": current_patient_id,
+        }
+    
+    except Exception as e:
+        return {
+            "level": 3,
+            "success": False,
+            "error": str(e),
+            "response": ""
+        }
+
+
+async def evaluate_level(
+    level: int,
+    user_input: str,
+    current_patient_id: str = "patient_001",
+    secret_token: str = "",
+    model: str = "",
+) -> dict:
+    """
+    Evaluate the BOLA vulnerability at a specific level using TWO LLM calls.
+    
+    Call 1 (Planner): Identifies what action (medication/prescription) to retrieve
+    Call 2 (Responder): Provides the data for the action
+    
+    The vulnerability progression:
+    - Level 1: Planner chooses BOTH action AND patient (unrestricted)
+    - Level 2: Planner chooses action + patient, but instruction says use current patient (bypassable)
+    - Level 3: Planner chooses only action, patient is hardcoded by backend (secure)
+    
+    Args:
+        level: Vulnerability level (1-3)
+        user_input: User's query
+        current_patient_id: The authenticated patient ID (default: "patient_001")
+        secret_token: Security token for verification
+        model: LLM model to use
+    
+    Returns:
+        dict with response and planning metadata
+    """
+    if level == 1:
+        return await evaluate_level_1(user_input, current_patient_id, model)
+    elif level == 2:
+        return await evaluate_level_2(user_input, current_patient_id, model)
+    elif level == 3:
+        return await evaluate_level_3(user_input, current_patient_id, model)
+    else:
+        raise ValueError(f"Invalid level: {level}")
+
+
+def verify_level_secret(level: int, token: str = "") -> bool:
+    """Verify level secret (not used in BOLA lab)."""
+    return True
diff --git a/src/static/facade/bola/bola_chatbot_level1.css b/src/static/facade/bola/bola_chatbot_level1.css
new file mode 100644
index 0000000..0883c4c
--- /dev/null
+++ b/src/static/facade/bola/bola_chatbot_level1.css
@@ -0,0 +1,362 @@
+/* BOLA Chatbot Styles */
+
+.bola-chatbot-container {
+  max-width: 1200px;
+  margin: 0 auto;
+  padding: 20px;
+  font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
+}
+
+.bola-header {
+  background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+  color: white;
+  padding: 25px;
+  border-radius: 8px;
+  margin-bottom: 25px;
+  box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
+}
+
+.bola-header h2 {
+  margin: 0 0 10px 0;
+  font-size: 24px;
+}
+
+.bola-description {
+  margin: 0;
+  font-size: 14px;
+  opacity: 0.95;
+  line-height: 1.5;
+}
+
+.bola-info-panel {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(300px, 1fr));
+  gap: 20px;
+  margin-bottom: 25px;
+}
+
+.info-section {
+  background: white;
+  border: 1px solid #e0e0e0;
+  border-radius: 6px;
+  padding: 15px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.05);
+}
+
+.info-section h4 {
+  margin: 0 0 12px 0;
+  color: #333;
+  font-size: 14px;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+}
+
+.patient-selector {
+  width: 100%;
+  padding: 10px;
+  border: 1px solid #ddd;
+  border-radius: 4px;
+  background: white;
+  font-size: 14px;
+  cursor: pointer;
+}
+
+.patient-selector:hover {
+  border-color: #667eea;
+}
+
+.patient-id-display {
+  background: #e3f2fd;
+  border-left: 4px solid #1976d2;
+  padding: 12px;
+  border-radius: 4px;
+  font-weight: 500;
+  color: #1976d2;
+  font-size: 14px;
+}
+
+.patient-list {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+}
+
+.patient-badge {
+  display: inline-block;
+  background: #f0f4ff;
+  color: #667eea;
+  padding: 6px 12px;
+  border-radius: 20px;
+  font-size: 12px;
+  font-weight: 500;
+  border: 1px solid #667eea;
+}
+
+.security-note {
+  background: #fff3cd;
+  border-left: 4px solid #ffc107;
+  padding: 12px;
+  border-radius: 4px;
+  font-size: 13px;
+  font-family: 'Monaco', 'Courier New', monospace;
+}
+
+.vuln-list {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+}
+
+.vuln-list li {
+  padding: 8px 0;
+  font-size: 13px;
+  border-bottom: 1px solid #f0f0f0;
+}
+
+.vuln-list li:last-child {
+  border-bottom: none;
+}
+
+.challenge-text {
+  margin: 0;
+  font-size: 13px;
+  line-height: 1.6;
+  color: #333;
+}
+
+.bola-chat-area {
+  background: white;
+  border: 1px solid #e0e0e0;
+  border-radius: 6px;
+  padding: 20px;
+  margin-bottom: 20px;
+  min-height: 250px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.05);
+}
+
+.chat-history {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+  max-height: 400px;
+  overflow-y: auto;
+}
+
+.chat-message {
+  padding: 12px 15px;
+  border-radius: 8px;
+  word-wrap: break-word;
+  font-size: 13px;
+  line-height: 1.5;
+}
+
+.chat-message.user {
+  background: #e3f2fd;
+  margin-left: 20%;
+  color: #1976d2;
+  border-left: 3px solid #1976d2;
+}
+
+.chat-message.bot {
+  background: #f5f5f5;
+  margin-right: 20%;
+  color: #333;
+}
+
+.chat-message.bot.error {
+  background: #ffebee;
+  color: #c62828;
+}
+
+.bola-attack-suggestions {
+  background: #f9f9f9;
+  border: 1px solid #e0e0e0;
+  border-radius: 6px;
+  padding: 20px;
+  margin-bottom: 20px;
+}
+
+.bola-attack-suggestions h4 {
+  margin: 0 0 15px 0;
+  color: #333;
+  font-size: 14px;
+  font-weight: 600;
+}
+
+.attack-btn {
+  display: block;
+  width: 100%;
+  padding: 12px;
+  margin-bottom: 10px;
+  background: #667eea;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+  font-weight: 500;
+  transition: all 0.2s;
+  text-align: left;
+  padding-left: 15px;
+}
+
+.attack-btn:hover {
+  background: #5568d3;
+  transform: translateX(5px);
+}
+
+.attack-btn:active {
+  transform: translateX(5px) scale(0.98);
+}
+
+.info-text {
+  margin: 12px 0 0 0;
+  font-size: 12px;
+  color: #666;
+  font-style: italic;
+}
+
+.bola-input-area {
+  display: flex;
+  gap: 10px;
+  margin-bottom: 20px;
+}
+
+.chat-input {
+  flex: 1;
+  padding: 12px;
+  border: 1px solid #ddd;
+  border-radius: 4px;
+  font-family: inherit;
+  font-size: 14px;
+  resize: vertical;
+  min-height: 80px;
+}
+
+.chat-input:focus {
+  outline: none;
+  border-color: #667eea;
+  box-shadow: 0 0 0 3px rgba(102, 126, 234, 0.1);
+}
+
+.send-button {
+  background: #667eea;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  padding: 12px 25px;
+  cursor: pointer;
+  font-weight: 600;
+  font-size: 14px;
+  transition: all 0.2s;
+  align-self: flex-end;
+}
+
+.send-button:hover {
+  background: #5568d3;
+  transform: translateY(-2px);
+  box-shadow: 0 4px 8px rgba(102, 126, 234, 0.3);
+}
+
+.send-button:active {
+  transform: translateY(0);
+}
+
+.send-button:disabled {
+  background: #ccc;
+  cursor: not-allowed;
+  transform: none;
+}
+
+.result-panel {
+  background: white;
+  border: 1px solid #e0e0e0;
+  border-radius: 6px;
+  padding: 20px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.05);
+}
+
+.result-content h4 {
+  margin: 0 0 15px 0;
+  color: #333;
+  font-size: 14px;
+  font-weight: 600;
+}
+
+.response-text {
+  background: #f5f5f5;
+  border-left: 3px solid #667eea;
+  padding: 15px;
+  border-radius: 4px;
+  font-size: 13px;
+  line-height: 1.6;
+  color: #333;
+  word-wrap: break-word;
+  max-height: 300px;
+  overflow-y: auto;
+}
+
+.data-accessed {
+  margin-top: 20px;
+  background: #ffebee;
+  border: 2px solid #f44336;
+  border-radius: 4px;
+  padding: 15px;
+}
+
+.data-accessed h4 {
+  color: #c62828;
+  margin: 0 0 10px 0;
+}
+
+.data-accessed pre {
+  background: #fff;
+  border: 1px solid #f44336;
+  padding: 10px;
+  border-radius: 4px;
+  overflow-x: auto;
+  font-size: 12px;
+  margin: 0;
+}
+
+.security-passed {
+  margin-top: 20px;
+  background: #e8f5e9;
+  border: 2px solid #4caf50;
+  border-radius: 4px;
+  padding: 15px;
+  color: #2e7d32;
+}
+
+.security-passed h4 {
+  color: #1b5e20;
+  margin: 0 0 8px 0;
+}
+
+.security-passed p {
+  margin: 0;
+  font-size: 13px;
+}
+
+@media (max-width: 768px) {
+  .bola-info-panel {
+    grid-template-columns: 1fr;
+  }
+
+  .chat-message.user {
+    margin-left: 10%;
+  }
+
+  .chat-message.bot {
+    margin-right: 10%;
+  }
+
+  .bola-input-area {
+    flex-direction: column;
+  }
+
+  .send-button {
+    width: 100%;
+  }
+}
diff --git a/src/static/facade/bola/bola_chatbot_level1.html b/src/static/facade/bola/bola_chatbot_level1.html
new file mode 100644
index 0000000..1361d35
--- /dev/null
+++ b/src/static/facade/bola/bola_chatbot_level1.html
@@ -0,0 +1,33 @@
+  <div class="bola-chatbot-container">
+    <div class="bola-header">
+      <h2>BOLA Chatbot - Level 1: No Access Controls</h2>
+      <p class="bola-description">
+        A medical chatbot with <strong>NO access controls</strong>. Can you get the chatbot to reveal 
+        <strong>other patients' medical data</strong> (medications or prescriptions)?
+      </p>
+    </div>
+
+    <div class="bola-info-panel">
+      <div class="info-section">
+        <h4>Your Patient ID (You are logged in as)</h4>
+        <div class="patient-id-display">patient_001 (John Doe)</div>
+      </div>
+      <div class="info-section">
+        <h4>Challenge</h4>
+        <p class="challenge-text">
+          🎯 Try to get the chatbot to show you medications or prescriptions for 
+          <strong>patient_002</strong> or <strong>patient_003</strong>. 
+          What data can you access?
+        </p>
+      </div>
+    </div>
+
+    <div id="chatArea" class="bola-chat-area" style="display:none;">
+      <div id="chatHistory" class="chat-history"></div>
+    </div>
+
+    <div class="bola-input-area">
+      <textarea id="userQuery" class="chat-input" placeholder="Ask for medications or prescriptions..."></textarea>
+      <button id="sendBtn" class="send-button">Send</button>
+    </div>
+  </div>
\ No newline at end of file
diff --git a/src/static/facade/bola/bola_chatbot_level1.js b/src/static/facade/bola/bola_chatbot_level1.js
new file mode 100644
index 0000000..9e1c661
--- /dev/null
+++ b/src/static/facade/bola/bola_chatbot_level1.js
@@ -0,0 +1,141 @@
+/* BOLA Chatbot JavaScript */
+
+const API_PREFIX = '/llmforge';
+const CONTROLLER_SLUG = 'bola-chatbot';
+
+class BOLAChatbot {
+  constructor(defaultLevel) {
+    this.currentLevel = getCurrentLevel(defaultLevel);
+    this.initializeElements();
+    this.setupEventListeners();
+  }
+
+  initializeElements() {
+    this.userQueryInput = document.getElementById('userQuery');
+    this.sendBtn = document.getElementById('sendBtn');
+    this.chatHistory = document.getElementById('chatHistory');
+    this.chatArea = document.getElementById('chatArea');
+  }
+
+  setupEventListeners() {
+    this.sendBtn.addEventListener('click', () => this.sendQuery());
+    this.userQueryInput.addEventListener('keypress', (e) => {
+      if (e.key === 'Enter' && e.ctrlKey) {
+        this.sendQuery();
+      }
+    });
+  }
+
+  addChatMessage(role, content) {
+    if (!this.chatHistory) {
+      return;
+    }
+    if (this.chatArea) {
+      this.chatArea.style.display = 'block';
+    }
+    const messageDiv = document.createElement('div');
+    messageDiv.className = `chat-message ${role}`;
+    messageDiv.textContent = content;
+    this.chatHistory.appendChild(messageDiv);
+    this.chatHistory.scrollTop = this.chatHistory.scrollHeight;
+  }
+
+  async sendQuery() {
+    const userInput = this.userQueryInput.value.trim();
+    if (!userInput) return;
+
+    this.addChatMessage('user', userInput);
+    this.userQueryInput.value = '';
+    this.sendBtn.disabled = true;
+
+    try {
+      const response = await fetch(getEndpointForLevel(this.currentLevel), {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          user_input: userInput,
+        }),
+      });
+
+      const data = await parseResponseBody(response);
+      
+      if (!response.ok) {
+        const errorMessage = responseMessage(data, 'Request failed.');
+        this.addChatMessage('bot error', `Error: ${errorMessage}`);
+        return;
+      }
+
+      if (data.success) {
+        const botResponse = data.response || 'No response received';
+        this.addChatMessage('bot', botResponse);
+      } else {
+        this.addChatMessage('bot error', `Error: ${responseMessage(data, 'Unknown error')}`);
+      }
+    } catch (error) {
+      this.addChatMessage('bot error', `Request failed: ${error.message}`);
+    } finally {
+      this.sendBtn.disabled = false;
+    }
+  }
+
+}
+
+// Utility Functions
+
+function getCurrentLevel() {
+  const levelIdentifier = String(window.getCurrentVulnerabilityLevel() || '');
+  const match = /level[_-]?(\d+)/i.exec(levelIdentifier);
+  return match ? Number(match[1]) : 1;
+}
+
+function getEndpointForLevel(level) {
+  return `${API_PREFIX}/api/v1/vulnerabilities/${CONTROLLER_SLUG}/level${level}`;
+}
+
+async function parseResponseBody(response) {
+  const contentType = response.headers.get('content-type') || '';
+  if (contentType.includes('application/json')) {
+    return await response.json();
+  }
+
+  const text = await response.text();
+  return { detail: text || 'Unexpected empty response from server.' };
+}
+
+function responseMessage(data, fallback) {
+  if (!data) {
+    return fallback;
+  }
+  if (typeof data.error === 'string' && data.error.trim()) {
+    return data.error;
+  }
+  if (typeof data.message === 'string' && data.message.trim()) {
+    return data.message;
+  }
+  if (typeof data.detail === 'string' && data.detail.trim()) {
+    return data.detail;
+  }
+  return fallback;
+}
+
+function injectPrompt(prompt) {
+  const input = document.getElementById('userQuery');
+  input.value = prompt;
+  input.focus();
+}
+
+function initializeChatbot() {
+  if (!document.getElementById('sendBtn') || !document.getElementById('userQuery')) {
+    return;
+  }
+
+  window.chatbot = new BOLAChatbot();
+}
+
+if (document.readyState === 'loading') {
+  document.addEventListener('DOMContentLoaded', () => initializeChatbot(), { once: true });
+} else {
+  initializeChatbot();
+}
diff --git a/src/static/facade/bola/bola_chatbot_level2.css b/src/static/facade/bola/bola_chatbot_level2.css
new file mode 100644
index 0000000..0883c4c
--- /dev/null
+++ b/src/static/facade/bola/bola_chatbot_level2.css
@@ -0,0 +1,362 @@
+/* BOLA Chatbot Styles */
+
+.bola-chatbot-container {
+  max-width: 1200px;
+  margin: 0 auto;
+  padding: 20px;
+  font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
+}
+
+.bola-header {
+  background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+  color: white;
+  padding: 25px;
+  border-radius: 8px;
+  margin-bottom: 25px;
+  box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
+}
+
+.bola-header h2 {
+  margin: 0 0 10px 0;
+  font-size: 24px;
+}
+
+.bola-description {
+  margin: 0;
+  font-size: 14px;
+  opacity: 0.95;
+  line-height: 1.5;
+}
+
+.bola-info-panel {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(300px, 1fr));
+  gap: 20px;
+  margin-bottom: 25px;
+}
+
+.info-section {
+  background: white;
+  border: 1px solid #e0e0e0;
+  border-radius: 6px;
+  padding: 15px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.05);
+}
+
+.info-section h4 {
+  margin: 0 0 12px 0;
+  color: #333;
+  font-size: 14px;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+}
+
+.patient-selector {
+  width: 100%;
+  padding: 10px;
+  border: 1px solid #ddd;
+  border-radius: 4px;
+  background: white;
+  font-size: 14px;
+  cursor: pointer;
+}
+
+.patient-selector:hover {
+  border-color: #667eea;
+}
+
+.patient-id-display {
+  background: #e3f2fd;
+  border-left: 4px solid #1976d2;
+  padding: 12px;
+  border-radius: 4px;
+  font-weight: 500;
+  color: #1976d2;
+  font-size: 14px;
+}
+
+.patient-list {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+}
+
+.patient-badge {
+  display: inline-block;
+  background: #f0f4ff;
+  color: #667eea;
+  padding: 6px 12px;
+  border-radius: 20px;
+  font-size: 12px;
+  font-weight: 500;
+  border: 1px solid #667eea;
+}
+
+.security-note {
+  background: #fff3cd;
+  border-left: 4px solid #ffc107;
+  padding: 12px;
+  border-radius: 4px;
+  font-size: 13px;
+  font-family: 'Monaco', 'Courier New', monospace;
+}
+
+.vuln-list {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+}
+
+.vuln-list li {
+  padding: 8px 0;
+  font-size: 13px;
+  border-bottom: 1px solid #f0f0f0;
+}
+
+.vuln-list li:last-child {
+  border-bottom: none;
+}
+
+.challenge-text {
+  margin: 0;
+  font-size: 13px;
+  line-height: 1.6;
+  color: #333;
+}
+
+.bola-chat-area {
+  background: white;
+  border: 1px solid #e0e0e0;
+  border-radius: 6px;
+  padding: 20px;
+  margin-bottom: 20px;
+  min-height: 250px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.05);
+}
+
+.chat-history {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+  max-height: 400px;
+  overflow-y: auto;
+}
+
+.chat-message {
+  padding: 12px 15px;
+  border-radius: 8px;
+  word-wrap: break-word;
+  font-size: 13px;
+  line-height: 1.5;
+}
+
+.chat-message.user {
+  background: #e3f2fd;
+  margin-left: 20%;
+  color: #1976d2;
+  border-left: 3px solid #1976d2;
+}
+
+.chat-message.bot {
+  background: #f5f5f5;
+  margin-right: 20%;
+  color: #333;
+}
+
+.chat-message.bot.error {
+  background: #ffebee;
+  color: #c62828;
+}
+
+.bola-attack-suggestions {
+  background: #f9f9f9;
+  border: 1px solid #e0e0e0;
+  border-radius: 6px;
+  padding: 20px;
+  margin-bottom: 20px;
+}
+
+.bola-attack-suggestions h4 {
+  margin: 0 0 15px 0;
+  color: #333;
+  font-size: 14px;
+  font-weight: 600;
+}
+
+.attack-btn {
+  display: block;
+  width: 100%;
+  padding: 12px;
+  margin-bottom: 10px;
+  background: #667eea;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+  font-weight: 500;
+  transition: all 0.2s;
+  text-align: left;
+  padding-left: 15px;
+}
+
+.attack-btn:hover {
+  background: #5568d3;
+  transform: translateX(5px);
+}
+
+.attack-btn:active {
+  transform: translateX(5px) scale(0.98);
+}
+
+.info-text {
+  margin: 12px 0 0 0;
+  font-size: 12px;
+  color: #666;
+  font-style: italic;
+}
+
+.bola-input-area {
+  display: flex;
+  gap: 10px;
+  margin-bottom: 20px;
+}
+
+.chat-input {
+  flex: 1;
+  padding: 12px;
+  border: 1px solid #ddd;
+  border-radius: 4px;
+  font-family: inherit;
+  font-size: 14px;
+  resize: vertical;
+  min-height: 80px;
+}
+
+.chat-input:focus {
+  outline: none;
+  border-color: #667eea;
+  box-shadow: 0 0 0 3px rgba(102, 126, 234, 0.1);
+}
+
+.send-button {
+  background: #667eea;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  padding: 12px 25px;
+  cursor: pointer;
+  font-weight: 600;
+  font-size: 14px;
+  transition: all 0.2s;
+  align-self: flex-end;
+}
+
+.send-button:hover {
+  background: #5568d3;
+  transform: translateY(-2px);
+  box-shadow: 0 4px 8px rgba(102, 126, 234, 0.3);
+}
+
+.send-button:active {
+  transform: translateY(0);
+}
+
+.send-button:disabled {
+  background: #ccc;
+  cursor: not-allowed;
+  transform: none;
+}
+
+.result-panel {
+  background: white;
+  border: 1px solid #e0e0e0;
+  border-radius: 6px;
+  padding: 20px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.05);
+}
+
+.result-content h4 {
+  margin: 0 0 15px 0;
+  color: #333;
+  font-size: 14px;
+  font-weight: 600;
+}
+
+.response-text {
+  background: #f5f5f5;
+  border-left: 3px solid #667eea;
+  padding: 15px;
+  border-radius: 4px;
+  font-size: 13px;
+  line-height: 1.6;
+  color: #333;
+  word-wrap: break-word;
+  max-height: 300px;
+  overflow-y: auto;
+}
+
+.data-accessed {
+  margin-top: 20px;
+  background: #ffebee;
+  border: 2px solid #f44336;
+  border-radius: 4px;
+  padding: 15px;
+}
+
+.data-accessed h4 {
+  color: #c62828;
+  margin: 0 0 10px 0;
+}
+
+.data-accessed pre {
+  background: #fff;
+  border: 1px solid #f44336;
+  padding: 10px;
+  border-radius: 4px;
+  overflow-x: auto;
+  font-size: 12px;
+  margin: 0;
+}
+
+.security-passed {
+  margin-top: 20px;
+  background: #e8f5e9;
+  border: 2px solid #4caf50;
+  border-radius: 4px;
+  padding: 15px;
+  color: #2e7d32;
+}
+
+.security-passed h4 {
+  color: #1b5e20;
+  margin: 0 0 8px 0;
+}
+
+.security-passed p {
+  margin: 0;
+  font-size: 13px;
+}
+
+@media (max-width: 768px) {
+  .bola-info-panel {
+    grid-template-columns: 1fr;
+  }
+
+  .chat-message.user {
+    margin-left: 10%;
+  }
+
+  .chat-message.bot {
+    margin-right: 10%;
+  }
+
+  .bola-input-area {
+    flex-direction: column;
+  }
+
+  .send-button {
+    width: 100%;
+  }
+}
diff --git a/src/static/facade/bola/bola_chatbot_level2.html b/src/static/facade/bola/bola_chatbot_level2.html
new file mode 100644
index 0000000..dab937b
--- /dev/null
+++ b/src/static/facade/bola/bola_chatbot_level2.html
@@ -0,0 +1,33 @@
+  <div class="bola-chatbot-container">
+    <div class="bola-header">
+      <h2>BOLA Chatbot - Level 2: Prompt-Level Guard Rails</h2>
+      <p class="bola-description">
+        A medical chatbot with <strong>prompt-level guard rails</strong>. The system is instructed to only serve 
+        your data (patient_001). Can you use <strong>prompt injection</strong> to bypass this and access 
+        <strong>other patients' medical data</strong>?
+      </p>
+    </div>
+
+    <div class="bola-info-panel">
+      <div class="info-section">
+        <h4>Your Patient ID (Authenticated as)</h4>
+        <div class="patient-id-display">patient_001 (John Doe)</div>
+      </div>
+      <div class="info-section">
+        <h4>Challenge</h4>
+        <p class="challenge-text">
+          🎯 Can you craft a prompt that tricks the chatbot into 
+          revealing medications or prescriptions for patient_002 or patient_003?
+          Hint: Think about prompt injection techniques!
+        </p>
+      </div>
+    </div>
+    <div id="chatArea" class="bola-chat-area" style="display:none;">
+      <div id="chatHistory" class="chat-history"></div>
+    </div>
+
+    <div class="bola-input-area">
+      <textarea id="userQuery" class="chat-input" placeholder="Try to inject prompts to bypass the guard rails..."></textarea>
+      <button id="sendBtn" class="send-button">Send</button>
+    </div>
+  </div>
\ No newline at end of file
diff --git a/src/static/facade/bola/bola_chatbot_level2.js b/src/static/facade/bola/bola_chatbot_level2.js
new file mode 100644
index 0000000..9e1c661
--- /dev/null
+++ b/src/static/facade/bola/bola_chatbot_level2.js
@@ -0,0 +1,141 @@
+/* BOLA Chatbot JavaScript */
+
+const API_PREFIX = '/llmforge';
+const CONTROLLER_SLUG = 'bola-chatbot';
+
+class BOLAChatbot {
+  constructor(defaultLevel) {
+    this.currentLevel = getCurrentLevel(defaultLevel);
+    this.initializeElements();
+    this.setupEventListeners();
+  }
+
+  initializeElements() {
+    this.userQueryInput = document.getElementById('userQuery');
+    this.sendBtn = document.getElementById('sendBtn');
+    this.chatHistory = document.getElementById('chatHistory');
+    this.chatArea = document.getElementById('chatArea');
+  }
+
+  setupEventListeners() {
+    this.sendBtn.addEventListener('click', () => this.sendQuery());
+    this.userQueryInput.addEventListener('keypress', (e) => {
+      if (e.key === 'Enter' && e.ctrlKey) {
+        this.sendQuery();
+      }
+    });
+  }
+
+  addChatMessage(role, content) {
+    if (!this.chatHistory) {
+      return;
+    }
+    if (this.chatArea) {
+      this.chatArea.style.display = 'block';
+    }
+    const messageDiv = document.createElement('div');
+    messageDiv.className = `chat-message ${role}`;
+    messageDiv.textContent = content;
+    this.chatHistory.appendChild(messageDiv);
+    this.chatHistory.scrollTop = this.chatHistory.scrollHeight;
+  }
+
+  async sendQuery() {
+    const userInput = this.userQueryInput.value.trim();
+    if (!userInput) return;
+
+    this.addChatMessage('user', userInput);
+    this.userQueryInput.value = '';
+    this.sendBtn.disabled = true;
+
+    try {
+      const response = await fetch(getEndpointForLevel(this.currentLevel), {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          user_input: userInput,
+        }),
+      });
+
+      const data = await parseResponseBody(response);
+      
+      if (!response.ok) {
+        const errorMessage = responseMessage(data, 'Request failed.');
+        this.addChatMessage('bot error', `Error: ${errorMessage}`);
+        return;
+      }
+
+      if (data.success) {
+        const botResponse = data.response || 'No response received';
+        this.addChatMessage('bot', botResponse);
+      } else {
+        this.addChatMessage('bot error', `Error: ${responseMessage(data, 'Unknown error')}`);
+      }
+    } catch (error) {
+      this.addChatMessage('bot error', `Request failed: ${error.message}`);
+    } finally {
+      this.sendBtn.disabled = false;
+    }
+  }
+
+}
+
+// Utility Functions
+
+function getCurrentLevel() {
+  const levelIdentifier = String(window.getCurrentVulnerabilityLevel() || '');
+  const match = /level[_-]?(\d+)/i.exec(levelIdentifier);
+  return match ? Number(match[1]) : 1;
+}
+
+function getEndpointForLevel(level) {
+  return `${API_PREFIX}/api/v1/vulnerabilities/${CONTROLLER_SLUG}/level${level}`;
+}
+
+async function parseResponseBody(response) {
+  const contentType = response.headers.get('content-type') || '';
+  if (contentType.includes('application/json')) {
+    return await response.json();
+  }
+
+  const text = await response.text();
+  return { detail: text || 'Unexpected empty response from server.' };
+}
+
+function responseMessage(data, fallback) {
+  if (!data) {
+    return fallback;
+  }
+  if (typeof data.error === 'string' && data.error.trim()) {
+    return data.error;
+  }
+  if (typeof data.message === 'string' && data.message.trim()) {
+    return data.message;
+  }
+  if (typeof data.detail === 'string' && data.detail.trim()) {
+    return data.detail;
+  }
+  return fallback;
+}
+
+function injectPrompt(prompt) {
+  const input = document.getElementById('userQuery');
+  input.value = prompt;
+  input.focus();
+}
+
+function initializeChatbot() {
+  if (!document.getElementById('sendBtn') || !document.getElementById('userQuery')) {
+    return;
+  }
+
+  window.chatbot = new BOLAChatbot();
+}
+
+if (document.readyState === 'loading') {
+  document.addEventListener('DOMContentLoaded', () => initializeChatbot(), { once: true });
+} else {
+  initializeChatbot();
+}
diff --git a/src/static/facade/bola/bola_chatbot_level3.css b/src/static/facade/bola/bola_chatbot_level3.css
new file mode 100644
index 0000000..0883c4c
--- /dev/null
+++ b/src/static/facade/bola/bola_chatbot_level3.css
@@ -0,0 +1,362 @@
+/* BOLA Chatbot Styles */
+
+.bola-chatbot-container {
+  max-width: 1200px;
+  margin: 0 auto;
+  padding: 20px;
+  font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
+}
+
+.bola-header {
+  background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+  color: white;
+  padding: 25px;
+  border-radius: 8px;
+  margin-bottom: 25px;
+  box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
+}
+
+.bola-header h2 {
+  margin: 0 0 10px 0;
+  font-size: 24px;
+}
+
+.bola-description {
+  margin: 0;
+  font-size: 14px;
+  opacity: 0.95;
+  line-height: 1.5;
+}
+
+.bola-info-panel {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(300px, 1fr));
+  gap: 20px;
+  margin-bottom: 25px;
+}
+
+.info-section {
+  background: white;
+  border: 1px solid #e0e0e0;
+  border-radius: 6px;
+  padding: 15px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.05);
+}
+
+.info-section h4 {
+  margin: 0 0 12px 0;
+  color: #333;
+  font-size: 14px;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+}
+
+.patient-selector {
+  width: 100%;
+  padding: 10px;
+  border: 1px solid #ddd;
+  border-radius: 4px;
+  background: white;
+  font-size: 14px;
+  cursor: pointer;
+}
+
+.patient-selector:hover {
+  border-color: #667eea;
+}
+
+.patient-id-display {
+  background: #e3f2fd;
+  border-left: 4px solid #1976d2;
+  padding: 12px;
+  border-radius: 4px;
+  font-weight: 500;
+  color: #1976d2;
+  font-size: 14px;
+}
+
+.patient-list {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px;
+}
+
+.patient-badge {
+  display: inline-block;
+  background: #f0f4ff;
+  color: #667eea;
+  padding: 6px 12px;
+  border-radius: 20px;
+  font-size: 12px;
+  font-weight: 500;
+  border: 1px solid #667eea;
+}
+
+.security-note {
+  background: #fff3cd;
+  border-left: 4px solid #ffc107;
+  padding: 12px;
+  border-radius: 4px;
+  font-size: 13px;
+  font-family: 'Monaco', 'Courier New', monospace;
+}
+
+.vuln-list {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+}
+
+.vuln-list li {
+  padding: 8px 0;
+  font-size: 13px;
+  border-bottom: 1px solid #f0f0f0;
+}
+
+.vuln-list li:last-child {
+  border-bottom: none;
+}
+
+.challenge-text {
+  margin: 0;
+  font-size: 13px;
+  line-height: 1.6;
+  color: #333;
+}
+
+.bola-chat-area {
+  background: white;
+  border: 1px solid #e0e0e0;
+  border-radius: 6px;
+  padding: 20px;
+  margin-bottom: 20px;
+  min-height: 250px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.05);
+}
+
+.chat-history {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+  max-height: 400px;
+  overflow-y: auto;
+}
+
+.chat-message {
+  padding: 12px 15px;
+  border-radius: 8px;
+  word-wrap: break-word;
+  font-size: 13px;
+  line-height: 1.5;
+}
+
+.chat-message.user {
+  background: #e3f2fd;
+  margin-left: 20%;
+  color: #1976d2;
+  border-left: 3px solid #1976d2;
+}
+
+.chat-message.bot {
+  background: #f5f5f5;
+  margin-right: 20%;
+  color: #333;
+}
+
+.chat-message.bot.error {
+  background: #ffebee;
+  color: #c62828;
+}
+
+.bola-attack-suggestions {
+  background: #f9f9f9;
+  border: 1px solid #e0e0e0;
+  border-radius: 6px;
+  padding: 20px;
+  margin-bottom: 20px;
+}
+
+.bola-attack-suggestions h4 {
+  margin: 0 0 15px 0;
+  color: #333;
+  font-size: 14px;
+  font-weight: 600;
+}
+
+.attack-btn {
+  display: block;
+  width: 100%;
+  padding: 12px;
+  margin-bottom: 10px;
+  background: #667eea;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  cursor: pointer;
+  font-size: 13px;
+  font-weight: 500;
+  transition: all 0.2s;
+  text-align: left;
+  padding-left: 15px;
+}
+
+.attack-btn:hover {
+  background: #5568d3;
+  transform: translateX(5px);
+}
+
+.attack-btn:active {
+  transform: translateX(5px) scale(0.98);
+}
+
+.info-text {
+  margin: 12px 0 0 0;
+  font-size: 12px;
+  color: #666;
+  font-style: italic;
+}
+
+.bola-input-area {
+  display: flex;
+  gap: 10px;
+  margin-bottom: 20px;
+}
+
+.chat-input {
+  flex: 1;
+  padding: 12px;
+  border: 1px solid #ddd;
+  border-radius: 4px;
+  font-family: inherit;
+  font-size: 14px;
+  resize: vertical;
+  min-height: 80px;
+}
+
+.chat-input:focus {
+  outline: none;
+  border-color: #667eea;
+  box-shadow: 0 0 0 3px rgba(102, 126, 234, 0.1);
+}
+
+.send-button {
+  background: #667eea;
+  color: white;
+  border: none;
+  border-radius: 4px;
+  padding: 12px 25px;
+  cursor: pointer;
+  font-weight: 600;
+  font-size: 14px;
+  transition: all 0.2s;
+  align-self: flex-end;
+}
+
+.send-button:hover {
+  background: #5568d3;
+  transform: translateY(-2px);
+  box-shadow: 0 4px 8px rgba(102, 126, 234, 0.3);
+}
+
+.send-button:active {
+  transform: translateY(0);
+}
+
+.send-button:disabled {
+  background: #ccc;
+  cursor: not-allowed;
+  transform: none;
+}
+
+.result-panel {
+  background: white;
+  border: 1px solid #e0e0e0;
+  border-radius: 6px;
+  padding: 20px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.05);
+}
+
+.result-content h4 {
+  margin: 0 0 15px 0;
+  color: #333;
+  font-size: 14px;
+  font-weight: 600;
+}
+
+.response-text {
+  background: #f5f5f5;
+  border-left: 3px solid #667eea;
+  padding: 15px;
+  border-radius: 4px;
+  font-size: 13px;
+  line-height: 1.6;
+  color: #333;
+  word-wrap: break-word;
+  max-height: 300px;
+  overflow-y: auto;
+}
+
+.data-accessed {
+  margin-top: 20px;
+  background: #ffebee;
+  border: 2px solid #f44336;
+  border-radius: 4px;
+  padding: 15px;
+}
+
+.data-accessed h4 {
+  color: #c62828;
+  margin: 0 0 10px 0;
+}
+
+.data-accessed pre {
+  background: #fff;
+  border: 1px solid #f44336;
+  padding: 10px;
+  border-radius: 4px;
+  overflow-x: auto;
+  font-size: 12px;
+  margin: 0;
+}
+
+.security-passed {
+  margin-top: 20px;
+  background: #e8f5e9;
+  border: 2px solid #4caf50;
+  border-radius: 4px;
+  padding: 15px;
+  color: #2e7d32;
+}
+
+.security-passed h4 {
+  color: #1b5e20;
+  margin: 0 0 8px 0;
+}
+
+.security-passed p {
+  margin: 0;
+  font-size: 13px;
+}
+
+@media (max-width: 768px) {
+  .bola-info-panel {
+    grid-template-columns: 1fr;
+  }
+
+  .chat-message.user {
+    margin-left: 10%;
+  }
+
+  .chat-message.bot {
+    margin-right: 10%;
+  }
+
+  .bola-input-area {
+    flex-direction: column;
+  }
+
+  .send-button {
+    width: 100%;
+  }
+}
diff --git a/src/static/facade/bola/bola_chatbot_level3.html b/src/static/facade/bola/bola_chatbot_level3.html
new file mode 100644
index 0000000..d809110
--- /dev/null
+++ b/src/static/facade/bola/bola_chatbot_level3.html
@@ -0,0 +1,33 @@
+  <div class="bola-chatbot-container">
+    <div class="bola-header">
+      <h2>BOLA Chatbot - Level 3: Application-Layer Guard Rails (Secure)</h2>
+      <p class="bola-description">
+        A medical chatbot with <strong>application-layer guard rails</strong>. Access controls are enforced 
+        at the backend, not just in the prompt. Can you break through and access other patients' data?
+      </p>
+    </div>
+
+    <div class="bola-info-panel">
+      <div class="info-section">
+        <h4>Your Patient ID (Authenticated as)</h4>
+        <div class="patient-id-display">patient_001 (John Doe)</div>
+      </div>
+
+      <div class="info-section">
+        <h4>Challenge</h4>
+        <p class="challenge-text">
+          🔒 Try your best! The access control is enforced at the backend layer. 
+          Can prompt injection or other techniques bypass application-level security?
+        </p>
+      </div>
+    </div>
+
+    <div id="chatArea" class="bola-chat-area" style="display:none;">
+      <div id="chatHistory" class="chat-history"></div>
+    </div>
+
+    <div class="bola-input-area">
+      <textarea id="userQuery" class="chat-input" placeholder="Try to access other patients' data (you will fail)..."></textarea>
+      <button id="sendBtn" class="send-button">Send</button>
+    </div>
+  </div>
\ No newline at end of file
diff --git a/src/static/facade/bola/bola_chatbot_level3.js b/src/static/facade/bola/bola_chatbot_level3.js
new file mode 100644
index 0000000..9e1c661
--- /dev/null
+++ b/src/static/facade/bola/bola_chatbot_level3.js
@@ -0,0 +1,141 @@
+/* BOLA Chatbot JavaScript */
+
+const API_PREFIX = '/llmforge';
+const CONTROLLER_SLUG = 'bola-chatbot';
+
+class BOLAChatbot {
+  constructor(defaultLevel) {
+    this.currentLevel = getCurrentLevel(defaultLevel);
+    this.initializeElements();
+    this.setupEventListeners();
+  }
+
+  initializeElements() {
+    this.userQueryInput = document.getElementById('userQuery');
+    this.sendBtn = document.getElementById('sendBtn');
+    this.chatHistory = document.getElementById('chatHistory');
+    this.chatArea = document.getElementById('chatArea');
+  }
+
+  setupEventListeners() {
+    this.sendBtn.addEventListener('click', () => this.sendQuery());
+    this.userQueryInput.addEventListener('keypress', (e) => {
+      if (e.key === 'Enter' && e.ctrlKey) {
+        this.sendQuery();
+      }
+    });
+  }
+
+  addChatMessage(role, content) {
+    if (!this.chatHistory) {
+      return;
+    }
+    if (this.chatArea) {
+      this.chatArea.style.display = 'block';
+    }
+    const messageDiv = document.createElement('div');
+    messageDiv.className = `chat-message ${role}`;
+    messageDiv.textContent = content;
+    this.chatHistory.appendChild(messageDiv);
+    this.chatHistory.scrollTop = this.chatHistory.scrollHeight;
+  }
+
+  async sendQuery() {
+    const userInput = this.userQueryInput.value.trim();
+    if (!userInput) return;
+
+    this.addChatMessage('user', userInput);
+    this.userQueryInput.value = '';
+    this.sendBtn.disabled = true;
+
+    try {
+      const response = await fetch(getEndpointForLevel(this.currentLevel), {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          user_input: userInput,
+        }),
+      });
+
+      const data = await parseResponseBody(response);
+      
+      if (!response.ok) {
+        const errorMessage = responseMessage(data, 'Request failed.');
+        this.addChatMessage('bot error', `Error: ${errorMessage}`);
+        return;
+      }
+
+      if (data.success) {
+        const botResponse = data.response || 'No response received';
+        this.addChatMessage('bot', botResponse);
+      } else {
+        this.addChatMessage('bot error', `Error: ${responseMessage(data, 'Unknown error')}`);
+      }
+    } catch (error) {
+      this.addChatMessage('bot error', `Request failed: ${error.message}`);
+    } finally {
+      this.sendBtn.disabled = false;
+    }
+  }
+
+}
+
+// Utility Functions
+
+function getCurrentLevel() {
+  const levelIdentifier = String(window.getCurrentVulnerabilityLevel() || '');
+  const match = /level[_-]?(\d+)/i.exec(levelIdentifier);
+  return match ? Number(match[1]) : 1;
+}
+
+function getEndpointForLevel(level) {
+  return `${API_PREFIX}/api/v1/vulnerabilities/${CONTROLLER_SLUG}/level${level}`;
+}
+
+async function parseResponseBody(response) {
+  const contentType = response.headers.get('content-type') || '';
+  if (contentType.includes('application/json')) {
+    return await response.json();
+  }
+
+  const text = await response.text();
+  return { detail: text || 'Unexpected empty response from server.' };
+}
+
+function responseMessage(data, fallback) {
+  if (!data) {
+    return fallback;
+  }
+  if (typeof data.error === 'string' && data.error.trim()) {
+    return data.error;
+  }
+  if (typeof data.message === 'string' && data.message.trim()) {
+    return data.message;
+  }
+  if (typeof data.detail === 'string' && data.detail.trim()) {
+    return data.detail;
+  }
+  return fallback;
+}
+
+function injectPrompt(prompt) {
+  const input = document.getElementById('userQuery');
+  input.value = prompt;
+  input.focus();
+}
+
+function initializeChatbot() {
+  if (!document.getElementById('sendBtn') || !document.getElementById('userQuery')) {
+    return;
+  }
+
+  window.chatbot = new BOLAChatbot();
+}
+
+if (document.readyState === 'loading') {
+  document.addEventListener('DOMContentLoaded', () => initializeChatbot(), { once: true });
+} else {
+  initializeChatbot();
+}