mainsequence 9.0.16.dev59__tar.gz → 9.0.17.dev60__tar.gz

{mainsequence-9.0.16.dev59 → mainsequence-9.0.17.dev60}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.16.dev59
+Version: 9.0.17.dev60
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.16.dev59 → mainsequence-9.0.17.dev60}/agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -191,6 +191,10 @@ def team_report(team_uid: str) -> dict[str, str]:
 
 - Authorize a requester-bound call against the requester. The acting
   application has no rights of its own unless the API's policy grants them.
+- The requester can authorize reads and writes within that person's own
+  member-level permissions. Before a write, check the exact object and action;
+  the example's team-membership check is not a general edit, run, share or
+  delete grant. The getter verifies identity, not operation permission.
 - Fail closed: an operation that needs a person refuses the call when
   `User.get_requester()` is `None`. Never fall back to the caller's rights.
 - Never read a person's UID from the request body, a header or a query
@@ -201,9 +205,20 @@ def team_report(team_uid: str) -> dict[str, str]:
   `is_organization_admin` is always `False`: a requester's access reaches the
   API at member level only.
 - Inside a requester-bound call, `reads_as_caller()` raises
-  `RequestIdentityError`: the requester's access is not passed on.
-- Test both paths: the requester-bound call authorized against the requester,
-  and the same operation refused without a requester.
+  `RequestIdentityError`: a receiving application cannot forward its inbound
+  requester-bearing assertion to the directory endpoints. Platform-authorized
+  Agent delegation is separate and keeps the original person and request time.
+- Hosted Agents never receive Secret values. The platform bounds work to at
+  most 24 hours after the original request and checks access on every call;
+  delegation does not restart that limit. This SDK does not enable platform
+  write endpoints or extend the inbound request scope.
+- A model-driven Agent can be steered by prompt injection. Its writes can
+  cause damage within the person's permissions; keep object/action checks and
+  any mutation approval required by the application's policy outside model
+  claims or tool arguments.
+- Test requester-authorized reads and writes, writes refused for a requester
+  without the necessary grant, and requester-required operations refused
+  without a requester even when the calling Agent has its own grants.
 
 Which applications may act for their requester, what that access covers, and
 what people are told:
@@ -218,7 +233,12 @@ To serve MCP tools from the same application, add the `mcp` extra and call
 after `install_request_identity(app)`, with a stateless FastMCP server that
 returns JSON. Tools authorize with `User.get_logged_user()` and
 `User.get_requester()` exactly like REST handlers; admission to the release
-does not authorize every tool. See
+does not authorize every tool. For a tool invoked by an Agent on a person's
+behalf, check that requester for both reads and writes. Refuse a
+requester-required write when the getter returns `None`, and verify object- and
+action-specific permission before mutation; read access and MCP annotations are not
+write authority. Ordinary non-requester calls retain their own caller policy.
+See
 [Serving MCP](https://mainsequence-sdk.github.io/mainsequence-sdk/knowledge/fastapi/#serving-mcp).
 
 ### Public provider callbacks and webhooks

{mainsequence-9.0.16.dev59 → mainsequence-9.0.17.dev60}/agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md

@@ -240,14 +240,26 @@ whose own request it is serving. The platform setting is `acts_for_requester`.
 
 ### What the requester's access covers
 
-- Read only: the application never changes, shares or deletes anything with it.
+- Reads and the creates, updates, runs, sharing changes and deletes the person
+  may make, where the platform endpoint supports requester-bound access.
+- Check the person's permission for the exact object and operation on every
+  call. A read grant or team membership alone does not authorize a write.
 - The requester's member level, never an admin's, even when the requester is
   an Organization admin.
-- Never secret values.
+- Hosted Agents never receive Secret values, including through this access.
 - At most 24 hours after the person's request, and only while the work for that
   request runs.
 - Checked again on every call, so it stops the moment the person's access ends.
-- Never passed on to another application.
+- Platform-authorized Agent-to-Agent delegation keeps the person who started
+  the work and the original request time. Each delegated Agent must itself be
+  enabled to act for its requester. Delegation cannot restart the time limit,
+  select another person or increase their permissions.
+- A receiving application cannot forward its inbound assertion to establish
+  another requester binding. `reads_as_caller()` still refuses these requests.
+
+These writes and delegation require platform support; installing this SDK does
+not enable them. Treat a refused operation as refused, never retry it with the
+application's own grants.
 
 ### Never accept a person's UID from a request
 
@@ -255,19 +267,32 @@ The requester comes only from the platform. An application never accepts a
 person's UID from a request body, header or query parameter, and never lets a
 caller choose whom it acts for. A FastAPI application that receives a
 requester-bound call reads the requester with `User.get_requester()` and
-authorizes the call against that person:
+authorizes reads and writes against that person's object- and operation-specific
+permissions:
 `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`.
 
 ### What people are told
 
-Every client that shows an application with `acts_for_requester` shows this
-statement:
-
-> **This Agent works with your identity, securely.** It reads only what you can already read, only to answer your own requests, and for at most 24 hours after you ask. It cannot act as anyone else, cannot change, share or delete anything, never sees your secret values, and stops the moment your access ends. Your Organization's administrator approved it to work this way.
-
-Show the plain limit with it: while it works on your request, the Agent's code
-can read what you can read, which is why only administrators decide which
-Agents may work this way.
+Every client that shows an application with `acts_for_requester` uses the exact
+platform-approved statement from
+[Platform ADR-0051, What people are told](https://github.com/Main-Sequence-Server-Side/tdag-django/blob/development/docs/platform/adr/adr-0051-requester-bound-access-for-workloads.md#11-what-people-are-told).
+Do not invent or paraphrase a separate SDK statement. For write-enabled
+deployments, the approved wording must cover supported reads and writes within
+the person's member-level permissions, Organization-admin approval without
+admin powers or Secret values, the original 24-hour limit including delegation,
+access revocation, and prompt-injection risk. Never present a write-enabled
+Agent as read-only or claim that it cannot change, share or delete anything.
+
+The platform behavior and approved write-enabled statement must ship together.
+If the platform still supplies only the earlier read-only text, do not claim
+the disclosure is ready for a write-enabled rollout or invent replacement words.
+
+Explain the risk alongside the statement: a model-driven Agent can be steered
+by prompt injection. Its reads and writes can reach as far as the person's
+member-level permissions allow, including sharing and deleting where
+supported, for at most 24 hours after the original request. Only Organization
+admins decide which Agents may receive this authority; the application's
+per-operation permission checks remain necessary.
 
 ## Review Rules
 
@@ -286,6 +311,8 @@ When reviewing an access-control task, look for:
 - an application that takes a person's UID from a request instead of from the
   platform
 - `acts_for_requester` presented as something a non-admin can enable
+- a requester-bound write authorized only by a read grant or the Agent's grants
+- prompt-injection risk hidden behind a claim that requester access is read-only
 
 ## Validation Checklist
 
@@ -304,6 +331,8 @@ Do not claim success until you have checked:
 - the task did not confuse sharing policy with orchestration or producer logic
 - an application that acts for its requester takes the person only from the
   platform, and its own grants are intentional
+- requester-bound writes enforce the person's permission for the operation,
+  and clients explain both the write risk and the original 24-hour limit
 
 ## This Skill Must Stop And Escalate When
 

{mainsequence-9.0.16.dev59 → mainsequence-9.0.17.dev60}/mainsequence/_request_identity.py

@@ -79,8 +79,8 @@ def _reads_as_caller():
         )
     if scope.requester is not None:
         raise RequestIdentityError(
-            "This request is requester-bound. The requester's access is not passed on, "
-            "so a requester-bound request cannot read as its caller."
+            "This request is requester-bound. reads_as_caller() cannot forward a "
+            "requester-bearing assertion to the directory endpoints."
         )
     if scope.caller_assertion is None:
         raise RequestIdentityError(

{mainsequence-9.0.16.dev59 → mainsequence-9.0.17.dev60}/mainsequence/client/models_user.py

@@ -1321,11 +1321,20 @@ class User(_CallerDirectoryReadMixin, UserApiBaseObjectOrm, BasePydanticModel):
         local mode and WebSockets. Raises ``RequestIdentityError`` outside an
         authenticated request, as ``get_logged_user()`` does.
 
-        Authorize a requester-bound request against the requester, and give the
-        acting application no rights of its own unless your policy grants them.
+        Authorize reads and writes against the requester's permission for the
+        exact object and operation. This getter verifies identity, not
+        authorization; read access or team membership does not authorize a
+        write. Give the acting application no rights of its own unless your
+        policy grants them.
         An operation that needs a person fails closed when this is ``None``.
         Never take a person's UID from a request body, header or query
-        parameter instead.
+        parameter instead. Platform-supported requester-bound writes stay
+        within the person's member-level rights, never admin powers or Secret
+        values. The platform checks access on every call and limits the work to
+        at most 24 hours after the original request, including across approved
+        Agent delegation. A model-driven Agent can be steered by prompt
+        injection, so per-operation checks remain necessary. This getter does
+        not enable platform write endpoints or extend its request scope.
         """
         requester = _get_requester()
         if requester is not None and not isinstance(requester, RequestUserIdentity):

{mainsequence-9.0.16.dev59 → mainsequence-9.0.17.dev60}/mainsequence/server/fastapi.py

@@ -295,8 +295,9 @@ def reads_as_caller():
     it. Raises ``RequestIdentityError`` outside an authenticated request or when
     the request carries no assertion (local mode, WebSockets); it never reads as
     the application instead. It also raises in a requester-bound request
-    (``User.get_requester()`` is not ``None``): the requester's access is not
-    passed on. See ADR-0036.
+    (``User.get_requester()`` is not ``None``): this helper cannot forward a
+    requester-bearing assertion to the directory endpoints. Platform-owned
+    Agent delegation is separate. See ADR-0036.
     """
     with _reads_as_caller():
         yield

{mainsequence-9.0.16.dev59 → mainsequence-9.0.17.dev60}/mainsequence.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.16.dev59
+Version: 9.0.17.dev60
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.16.dev59 → mainsequence-9.0.17.dev60}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.16.dev59"
+version = "9.0.17.dev60"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence-9.0.16.dev59 → mainsequence-9.0.17.dev60}/tests/test_fastapi_mcp.py

@@ -135,6 +135,47 @@ def test_tools_read_the_verified_caller_and_rest_routes_keep_working(signed):
     assert "/mcp" not in app.openapi()["paths"]
 
 
+def test_requester_bound_write_checks_the_person_without_workload_fallback(signed):
+    token, _, _ = signed
+    server = _server()
+    report_editors = {USER, OTHER}
+    writes = []
+
+    @server.tool()
+    async def publish_report() -> str:
+        requester = User.get_requester()
+        if requester is None or requester.uid not in report_editors:
+            raise PermissionError("The requester cannot publish this report.")
+        writes.append((User.get_logged_user().uid, requester.uid))
+        return requester.uid
+
+    app = _install(FastAPI(), server)
+    with TestClient(app) as client:
+        allowed = client.post(
+            "/mcp",
+            json=_call("publish_report"),
+            headers={
+                **MCP_HEADERS,
+                ASSERTION_HEADER: token(requester={"sub": OTHER, "team_uids": []}),
+            },
+        )
+        assert _text(allowed) == OTHER
+
+        for proof in (
+            token(requester={"sub": str(uuid4()), "team_uids": []}),
+            token(),
+        ):
+            refused = client.post(
+                "/mcp",
+                json=_call("publish_report"),
+                headers={**MCP_HEADERS, ASSERTION_HEADER: proof},
+            )
+            assert refused.status_code == 200
+            assert refused.json()["result"]["isError"] is True
+
+    assert writes == [(USER, OTHER)]
+
+
 def test_concurrent_callers_keep_their_own_identity(signed):
     token, _, _ = signed
     server = _server()