shiyuyun/wyndham-ARR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a891c0ae7a353fe3121fa2ecadbbe7ec89bcd03b
wyndham-ARR/.project-docs/10-decisions/ADR-002-controlled-agent-delegates-validation-to-system-boundaries.md
Wyndham ARR bf7939dd1a feat: sync latest ARR implementation
2026-07-31 15:11:42 +08:00

2.2 KiB
Raw Blame History

ADR-002: Controlled Agent Delegates Validation To System Boundaries

  • Status: Accepted
  • Date: 2026-07-29
  • Source: User clarification in the current session

Context

The ARR data-processing Agent is a dedicated Agent that accepts only business-system messages from a fixed, controlled entrypoint. Earlier Main Prompt revisions repeated contract, attachment, identity, hash and source checks already enforced by ARR code. A manual SuperAgent chat test also encouraged chat-input rejection logic, even though that entrypoint is outside the production contract.

The implementation already has three authoritative boundaries:

  1. ProcessingRequest and OssProcessingMessageBuilder validate and construct the fixed PROGRAM_INPUT.
  2. arr-opera-daily-ingest owns deterministic business processing and output validation.
  3. ARR MCP validates the grant and payload, independently replays the source XML, and commits in a database transaction.

Decision

  1. Main Prompt trusts PROGRAM_INPUT supplied by the controlled ARR entrypoint and does not repeat field, attachment, source, identity, hash or Schema validation.
  2. The Agent performs only fixed orchestration: one OSS fetch, one Skill run, one result read, at most one MCP submission, and one final output.
  3. Processing failure does not call MCP. MCP committed or already_committed remains the only successful submission outcome recognized by the Agent.
  4. Manual chat-upload behavior is not a production acceptance criterion. End-to-end testing starts at ARR Web or the equivalent controlled business-system entrypoint.
  5. If the Agent is ever exposed to untrusted/general inputs, validation must be added at the API/gateway boundary and this decision revisited; prompt prose must not be treated as the security boundary.

Consequences

  • The Main Prompt is shorter and avoids redundant LLM work and token/latency overhead.
  • Business and security validation remains deterministic in code rather than probabilistic in the Agent.
  • The fixed entrypoint and its access controls become an explicit operational prerequisite.
  • Direct SuperAgent chat tests may be useful for isolated Skill experiments but cannot prove or invalidate the production ingestion flow.