AI CORE / DOCUMENTATION

Authorization is checked at the point of action

A textual restriction in a model instruction does not replace technical enforcement of permissions. The profile focuses on boundaries that remain effective even when a model proposes an incorrect action.

Capabilities and identity

First distinguish an informational assistant from a system reading private data or making changes. Every action must have documented identity, authorization and scope. Delegation must not expand permissions. A tool may accept only explicitly permitted parameters and resources.

Untrusted inputs

A website, document, search result or tool response may contain malicious instructions. The system should treat them as data and must not derive new authorization from them. Assessment therefore examines the behavior of the whole chain, not just the initial prompt's wording.

Approval and stopping

A consequential operation needs corresponding approval bound to the specific action. Changed parameters may require new approval. Step, cost and time limits prevent uncontrolled execution; stopping effectiveness is also assessed when a tool fails.

Memory, sessions and privacy

Temporary data from one session must not appear to another user without authorization. Persistent memory needs rules for provenance, updating and deletion. An assessor should distinguish model context from an authoritative store and examine handling of false or harmful stored information.

MCP is an interface, not an exception

When an agent uses MCP, appropriate controls apply to server identification, authorization, communication boundaries and schemas. A public read-only source and a tool accessing private data have different requirements. The protocol alone establishes neither content trustworthiness nor correct authorization.

Agent profile 1.0.0 · Canonical illustrative record