Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-08 18:31:36 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add mcp knowledge category with 5 rules

Browse source 
Rules derived from BC MCP API page development experience:

- api-page-flowfields-must-be-calcfields: FlowFields return empty on API
  pages unless explicitly CalcFields'd in OnAfterGetRecord
- stored-derived-fields-must-not-be-exposed-directly: Stored fields updated
  only via OnValidate triggers can be stale; recalculate live in OnAfterGetRecord
- api-page-key-fields-must-be-editable-on-insert: ODataKeyFields with
  Editable=false are rejected as unknown properties on POST
- api-page-least-privilege-write-access: Create dedicated minimal pages per
  write concern rather than widening general-purpose pages
- agent-must-not-write-business-process-status: Agents must only write
  developer-tracking fields; business status fields affect invoicing/time registration

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Michael Dieringer 2026-06-20 13:48:06 +02:00
parent c2aaf92748
commit 935d756f05
5 changed files with 190 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

32
custom/knowledge/mcp/agent-must-not-write-business-process-status.md Normal file
View file

@ -0,0 +1,32 @@
# CURABIS MCP: Agents Must Not Write Business Process Status Fields
## Core Principle
MCP agents must only write developer-managed tracking fields — never fields that drive business process workflows such as invoicing, approval, or time registration. Writing a business status field from an agent can block downstream operations for users working in Business Central.
## The Distinction
| Field type | Examples | Agent may write |
|---|---|---|
| Developer tracking | `gitHubDevStatus`, `gitHubBranch` | Yes |
| Business process status | Task `Status` (Accepted, In progress, Done) | Never |
Developer tracking fields are independent of BC workflow. Business process status fields control what users can do — for example, a task marked as ready for invoicing cannot receive new time entries.
## Requirements
- API pages exposed to MCP agents must mark business status fields as `Editable = false`
- Agent instructions (`.agent.md` files) must explicitly list which fields the agent may write
- Any field that affects time registration, posting, approval, or invoicing is a business process field and must be read-only for agents
- Developer-managed fields (GitHub dev status, branch, comments) are the only writable surface
## Example Agent Instruction
```
Write only gitHubDevStatus and gitHubBranch on tasks.
Never write Status — it controls the invoicing workflow.
```
## Verification
For each API page with write access, verify that fields controlling BC workflow transitions carry `Editable = false`. Review the agent instruction file to confirm it names the allowed writable fields explicitly and prohibits status fields.