Trust boundary
Security and authorization
Read-only does not mean risk-free. The protocol requires explicit tenant scope, rooftop grants, safe errors, and resistance to cross-tenant discovery.
Three trust zones
| Zone | Contains | Rule |
|---|---|---|
| Agent client | User request, credentials, tool output | Treat returned text and media as untrusted content, not instructions. |
| Gateway boundary | Authorization, mappings, policy, audit | Validate every identifier and cursor inside the granted tenant and rooftop scope. |
| Source systems | Inventory, pricing, internal integrations | Never expose generic queries or source credentials through protocol tools. |
Public and authenticated views
A gateway may expose public discovery and dealer-approved catalog reads. Authoritative availability may be rate-limited or require authentication. The manifest describes the actual access policy; a client must not assume public access.
Isolation rules
- Authorize the requested dealer and rooftop for every call.
- Bind cursors to the tenant, query, and snapshot so they cannot be replayed across scope.
- Return non-enumerating errors for inaccessible identifiers.
- Minimize logs and retain only what the declared operational policy requires.
No customer data in version 0.1
Core tool inputs contain no customer PII. Outputs contain vehicle, offer, dealer, and public business-contact data—not leads, credit data, deal records, or customer profiles.
Gateway responsibility: an upstream adapter may connect to a DMS or other internal source, but that does not make the protocol a DMS API. Internal capabilities stay inaccessible.
NextConformance→