Browse documentation
Security and trust
Required defenses for cross-boundary questions and answers.
Threat model
AQP objects cross system boundaries and may request information, clarification, approval, preference, or corrective action. Implementations must assume malicious queries, coerced respondents, poisoned answers, forged provenance, continuation substitution, replay, SSRF, prompt injection, and sensitive-data leakage.
Approval and local authority
Approval is its own bounded query. Respondents and hosts MUST enforce their user, organization, legal, and product policies. Silence, timeout, unrelated tool approval, or an agent's prediction MUST NOT be treated as a human answer. The protected query stays hidden until approval is accepted.
Subject privacy
User subjects must use local or pairwise opaque identifiers. Names, emails, raw account identifiers, and globally correlatable customer identifiers must not appear in protocol objects.
Data minimization
Responses SHOULD answer only the declared prompt without exposing unrelated prompts, transcripts, credentials, personal data, secrets, or raw tool payloads. Collectors SHOULD enforce exact schemas and length limits. Validators must not fetch arbitrary remote schema references.
Response safety
Collectors must preserve respondent kind, source, confidence, query, and subject lineage. A response such as an approval or preference may trigger side effects, so downstream systems must verify that its scope and authority match the intended action. Answers entering memory, ranking, or training pipelines require poisoning defenses and reversible rollout.
Transport security
Bindings inherit the security requirements of their underlying transport. Implementations must validate schemas before processing, sanitize display text, validate file or URL references, enforce authentication and authorization, and avoid logging capabilities.