Security and trust

Required defenses for cross-boundary questions and answers.

Threat model

AQP objects cross system boundaries and may request information, clarification, approval, preference, or corrective action. Implementations must assume malicious queries, coerced respondents, poisoned answers, forged provenance, replay, SSRF, prompt injection, and sensitive-data leakage.

Data minimization

Responses SHOULD answer only the declared prompt without exposing unrelated prompts, transcripts, credentials, personal data, secrets, or raw tool payloads. Collectors SHOULD enforce strict schemas and length limits. Evidence should be represented as authorized references, not copied content.

Scoped authorization

Submission authority SHOULD be scoped to one query or subject, expire quickly, and resist replay. Bearer capabilities must not encode unnecessary customer or content data. Respondents MUST allowlist collector origins and require HTTPS for remote submission.

Response safety

Collectors must preserve respondent kind, source, confidence, query, and subject lineage. A response such as an approval or preference may trigger side effects, so downstream systems must verify that its scope and authority match the intended action. Answers entering memory, ranking, or training pipelines require poisoning defenses and reversible rollout.

Transport security

Bindings inherit the security requirements of their underlying transport. Implementations must validate schemas before processing, sanitize display text, validate file or URL references, enforce authentication and authorization, and avoid logging capabilities.