42 lines
2.2 KiB
Markdown
42 lines
2.2 KiB
Markdown
# ADR-002: Controlled Agent Delegates Validation To System Boundaries
|
|
|
|
- Status: Accepted
|
|
- Date: 2026-07-29
|
|
- Source: User clarification in the current session
|
|
|
|
## Context
|
|
|
|
The ARR data-processing Agent is a dedicated Agent that accepts only business-system messages from a fixed,
|
|
controlled entrypoint. Earlier Main Prompt revisions repeated contract, attachment, identity, hash and source
|
|
checks already enforced by ARR code. A manual SuperAgent chat test also encouraged chat-input rejection logic,
|
|
even though that entrypoint is outside the production contract.
|
|
|
|
The implementation already has three authoritative boundaries:
|
|
|
|
1. `ProcessingRequest` and `OssProcessingMessageBuilder` validate and construct the fixed PROGRAM_INPUT.
|
|
2. `arr-opera-daily-ingest` owns deterministic business processing and output validation.
|
|
3. ARR MCP validates the grant and payload, independently replays the source XML, and commits in a database
|
|
transaction.
|
|
|
|
## Decision
|
|
|
|
1. Main Prompt trusts PROGRAM_INPUT supplied by the controlled ARR entrypoint and does not repeat field,
|
|
attachment, source, identity, hash or Schema validation.
|
|
2. The Agent performs only fixed orchestration: one OSS fetch, one Skill run, one result read, at most one MCP
|
|
submission, and one final output.
|
|
3. Processing failure does not call MCP. MCP `committed` or `already_committed` remains the only successful
|
|
submission outcome recognized by the Agent.
|
|
4. Manual chat-upload behavior is not a production acceptance criterion. End-to-end testing starts at ARR Web
|
|
or the equivalent controlled business-system entrypoint.
|
|
5. If the Agent is ever exposed to untrusted/general inputs, validation must be added at the API/gateway boundary
|
|
and this decision revisited; prompt prose must not be treated as the security boundary.
|
|
|
|
## Consequences
|
|
|
|
- The Main Prompt is shorter and avoids redundant LLM work and token/latency overhead.
|
|
- Business and security validation remains deterministic in code rather than probabilistic in the Agent.
|
|
- The fixed entrypoint and its access controls become an explicit operational prerequisite.
|
|
- Direct SuperAgent chat tests may be useful for isolated Skill experiments but cannot prove or invalidate the
|
|
production ingestion flow.
|
|
|