Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-06 17:36:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
bcquality/custom/knowledge/mcp/agent-must-not-write-business-process-status.md
Michael Dieringer 935d756f05 Add mcp knowledge category with 5 rules 
Rules derived from BC MCP API page development experience:

- api-page-flowfields-must-be-calcfields: FlowFields return empty on API
  pages unless explicitly CalcFields'd in OnAfterGetRecord
- stored-derived-fields-must-not-be-exposed-directly: Stored fields updated
  only via OnValidate triggers can be stale; recalculate live in OnAfterGetRecord
- api-page-key-fields-must-be-editable-on-insert: ODataKeyFields with
  Editable=false are rejected as unknown properties on POST
- api-page-least-privilege-write-access: Create dedicated minimal pages per
  write concern rather than widening general-purpose pages
- agent-must-not-write-business-process-status: Agents must only write
  developer-tracking fields; business status fields affect invoicing/time registration

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-20 13:48:06 +02:00

1.6 KiB
Raw Blame History

CURABIS MCP: Agents Must Not Write Business Process Status Fields

Core Principle

MCP agents must only write developer-managed tracking fields — never fields that drive business process workflows such as invoicing, approval, or time registration. Writing a business status field from an agent can block downstream operations for users working in Business Central.

The Distinction

Field type Examples Agent may write
Developer tracking gitHubDevStatus, gitHubBranch Yes
Business process status Task Status (Accepted, In progress, Done) Never

Developer tracking fields are independent of BC workflow. Business process status fields control what users can do — for example, a task marked as ready for invoicing cannot receive new time entries.

Requirements

  • API pages exposed to MCP agents must mark business status fields as Editable = false
  • Agent instructions (.agent.md files) must explicitly list which fields the agent may write
  • Any field that affects time registration, posting, approval, or invoicing is a business process field and must be read-only for agents
  • Developer-managed fields (GitHub dev status, branch, comments) are the only writable surface

Example Agent Instruction

Write only gitHubDevStatus and gitHubBranch on tasks.
Never write Status — it controls the invoicing workflow.

Verification

For each API page with write access, verify that fields controlling BC workflow transitions carry Editable = false. Review the agent instruction file to confirm it names the allowed writable fields explicitly and prohibits status fields.