A production agent should not move directly from model output to an unrestricted API call. MIR inserts validation, authorization, execution boundaries, observation, and evidence into the loop.
Key takeaways
- Tools are security boundaries, not convenience callbacks.
- Permission should describe the side effect, reversibility, scope, and required approval.
- Retries are safe only when idempotency and partial-result behavior are known.
- Observe: read allowed state and tool availability.
- Plan: propose a bounded action.
- Validate: parse against the tool schema and policy.
- Act: execute with scoped credentials and resource limits.
- Record: emit results, artifacts, and policy decisions.
- Stop: complete, ask, pause, recover, or terminate.
Typed tool contracts
{
"toolId": "repository.applyPatch",
"version": "1.0",
"permissionClass": "reversible-write",
"inputSchema": { "type": "object", "required": ["patch"] },
"sideEffects": ["repository-write"],
"credentials": { "scope": ["repo:branch:write"], "ttlSeconds": 300 },
"execution": {
"timeoutSeconds": 60,
"idempotency": "required",
"checkpoint": "before-side-effect",
"rollback": "delete-branch"
},
"policy": { "requiredApprovals": ["merge", "deploy"] },
"evidence": ["validated-input", "diff", "result", "errors"]
}A tool contract should describe inputs, outputs, side effects, reversibility, idempotency, timeout, data classes, credential scope, egress, approval policy, and evidence requirements. Natural-language descriptions alone are insufficient for enforcement.
Retries, circuit breakers, rollback, and compensation
- Retry only operations declared idempotent or protected by an idempotency key.
- Use circuit breakers to stop repeated calls to a degraded dependency.
- Create a checkpoint before material side effects.
- Prefer direct rollback when supported; otherwise execute a documented compensating action.
- Escalate when the runtime cannot establish whether a side effect completed.
Connector trust boundaries
Tool output can contain untrusted instructions as well as data. The runtime should preserve provenance, distinguish data from control, minimize credentials, validate returned types, and enforce outbound network policy. MCP standardizes a connection surface, but it does not replace authorization, consent, tool review, or runtime policy. Source: MCP specification Source: OWASP guidance
Source record
References
- Model Context Protocol Specification — 2025-11-25 Primary source
Model Context Protocol project. Model Context Protocol. Published 2025-11-25; last reviewed 2026-06-24 UTC. Protocol specification.
- Agentic AI Threats and Mitigations Primary source
OWASP Agentic Security Initiative. OWASP. Published Current guidance; last reviewed 2026-06-20 UTC. Security guidance.
- LLM01:2025 Prompt Injection Primary source
OWASP GenAI Security Project. OWASP. Published 2025; last reviewed 2026-06-20 UTC. Security guidance.
National Institute of Standards and Technology. NIST. Published 2023-01-26; last reviewed 2026-06-20 UTC. Government framework.