Endpoint Boundaries

A public endpoint description can help tools discover what might be possible. It cannot, by itself, authorize calls, probing, persistence, delegation, escalation, data extraction, or private inference.

Five distinct endpoint surfaces

Scope

Endpoint access must be bounded by purpose, actor, capability, duration, data category, and revocation path.

Minimum implementation

Publish endpoint name, capability description, allowed actions, prohibited actions, and responsible maintainer.

Evidence to keep

Endpoint boundary statement, capability metadata, authorization path.

Consent

Consent must be explicit before an endpoint is used, expanded, delegated, or connected to an agent.

Minimum implementation

Require affirmative consent before tool calls or access expansion.

Evidence to keep

Consent log, scope version, user-visible approval record.

Logging

Endpoint use should leave reviewable records of action, actor, time, scope, result, and error state.

Minimum implementation

Log who or what called the endpoint, when, why, and under which authorization.

Evidence to keep

Action log, incident log, escalation log, proof-of-review record.

Revocation

Participants must be able to withdraw endpoint access and verify that withdrawal.

Minimum implementation

Publish a revocation path and confirm active permissions were disabled.

Evidence to keep

Revocation receipt, disabled token record, permission audit.

Local-first caution

Local access can be powerful. Local metadata and local tools are bounded civic surfaces, not ambient permission.

Minimum implementation

Treat local endpoints as sensitive even when the metadata is public.

Evidence to keep

Local-safe disclosure, no-private-probing note, human approval rule.

Human approval

Sensitive or escalating endpoint actions should require human approval before execution.

Minimum implementation

Pause escalation until a human approves the specific action and scope.

Evidence to keep

Approval record, reviewer ID or role, UTC timestamp, action summary.

No private probing

Capability discovery must not become covert scanning, data extraction, or inference beyond consent.

Minimum implementation

State that discovery is not permission to probe, infer, scrape, or execute.

Evidence to keep

Crawler rule, endpoint terms, audit of denied probes.

No hidden persistence

Agents and tools must not persist access channels outside the disclosed scope.

Minimum implementation

Disable credentials, cached tokens, or local channels when consent ends.

Evidence to keep

Token expiry, credential rotation record, persistence audit.

No escalation without review

Endpoint authority must not expand silently. Escalation requires review and renewed consent.

Minimum implementation

Define escalation triggers and require renewed approval before broader access.

Evidence to keep

Escalation policy, reviewer log, renewed consent record.

Least privilege and zero-trust posture

VNWO endpoint boundaries borrow a simple security lesson: discovery should not create ambient trust. Every endpoint action should be mediated by purpose, actor, capability, duration, environment, and revocation path. If scope changes, renewed consent or human approval should be required.

Endpoint refusal codes

A refusal code lets a tool deny overbroad requests without pretending that VNWO authorizes or executes endpoint behavior. The implementation remains local to the builder.

Boundary-aware authorization pseudocode

function authorizeEndpointCall(actor, endpoint, action, request):
    metadata = loadEndpointMetadata(endpoint)
    if action not in metadata.public_capabilities:
        deny("UNKNOWN_CAPABILITY")

    policy = resolveAuthorizationPolicy(actor, endpoint, action)
    if policy is null:
        deny("NO_AUTHORIZATION")

    if policy.requires_human_approval and not request.human_approval_token:
        deny("HUMAN_APPROVAL_REQUIRED")

    if request.expands_scope and not renewedConsentExists(actor, endpoint, action):
        deny("RENEWED_CONSENT_REQUIRED")

    decision = evaluatePolicy(policy, actor, request)
    logEndpointAttempt(actor, endpoint, action, decision, utcNow())

    if decision == "ALLOW":
        executeBoundedCall()
    else:
        deny(decision.reason)

Copy-safe endpoint boundary language

Public capability metadata is not authorization. This endpoint may be discovered publicly, but any use requires scoped consent, authorization by the implementing system, reviewable logs, a revocation path, and human approval for escalation. Discovery is not permission to probe, persist, extract, or widen access.