Default HTML escaping vs triple-stache with external sanitization for user content

A Handlebars.js template set needs to render content that may include characters such as & and < as well as a limited set of allowed markup from a data source. The documented behavior is that {{ }} escapes HTML entities by default to prevent XSS, while {{{ }}} bypasses escaping and outputs raw HTML.

The design constraint is consistent rendering across environments without weakening the overall security posture. Handlebars does not provide built-in sanitization for raw string output, and the strictEscaping configuration is a global toggle that affects all double-brace expressions. Using triple-stache on untrusted input is a documented risk, while relying solely on automatic escaping will encode markup that is intended to be rendered.

What is the appropriate boundary for allowing raw HTML in this context? Should triple-stache be reserved only for data that is pre-sanitized by an external library, and how does strictEscaping interact with the default escaping behavior for double braces in production?