# Engineering notes — Nir Vaknin

## Bound authority before adding tools.

An authenticated browser session carries more authority than most agent tasks need. In MCPatch, a useful tool starts with a named capability, a schema, and an allowed origin. The browser keeps its authentication material; the caller receives the capability result.

Approval is a separate boundary. Website content and model output are untrusted inputs, so neither can grant permission. Single-use approval and lifecycle revocation keep a previous decision from becoming indefinite authority. The tradeoff is more adapter and policy work for each capability.

## One writer makes failure easier to reason about.

A trading workflow combines scheduled analysis, changing market data, and human decisions. I separate these responsibilities so a successful scan does not itself authorize an order. Immutable decision data and freshness checks preserve what was known at the decision point.

Order authority belongs to one writer, and paper orders require human approval. That creates extra coordination, but it gives retries and stale inputs a clear place to stop. The pattern applies beyond trading: separate recommendations from the component allowed to act.

Basis: MCPatch threat model and Trading System case study. Independent project work.