mirror of
https://github.com/microsoft/BCQuality.git
synced 2026-08-07 18:06:53 +01:00
935d756f05
Rules derived from BC MCP API page development experience: - api-page-flowfields-must-be-calcfields: FlowFields return empty on API pages unless explicitly CalcFields'd in OnAfterGetRecord - stored-derived-fields-must-not-be-exposed-directly: Stored fields updated only via OnValidate triggers can be stale; recalculate live in OnAfterGetRecord - api-page-key-fields-must-be-editable-on-insert: ODataKeyFields with Editable=false are rejected as unknown properties on POST - api-page-least-privilege-write-access: Create dedicated minimal pages per write concern rather than widening general-purpose pages - agent-must-not-write-business-process-status: Agents must only write developer-tracking fields; business status fields affect invoicing/time registration Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
32 lines
1.6 KiB
Markdown
32 lines
1.6 KiB
Markdown
# CURABIS MCP: Agents Must Not Write Business Process Status Fields
|
|
|
|
## Core Principle
|
|
|
|
MCP agents must only write developer-managed tracking fields — never fields that drive business process workflows such as invoicing, approval, or time registration. Writing a business status field from an agent can block downstream operations for users working in Business Central.
|
|
|
|
## The Distinction
|
|
|
|
| Field type | Examples | Agent may write |
|
|
|---|---|---|
|
|
| Developer tracking | `gitHubDevStatus`, `gitHubBranch` | Yes |
|
|
| Business process status | Task `Status` (Accepted, In progress, Done) | Never |
|
|
|
|
Developer tracking fields are independent of BC workflow. Business process status fields control what users can do — for example, a task marked as ready for invoicing cannot receive new time entries.
|
|
|
|
## Requirements
|
|
|
|
- API pages exposed to MCP agents must mark business status fields as `Editable = false`
|
|
- Agent instructions (`.agent.md` files) must explicitly list which fields the agent may write
|
|
- Any field that affects time registration, posting, approval, or invoicing is a business process field and must be read-only for agents
|
|
- Developer-managed fields (GitHub dev status, branch, comments) are the only writable surface
|
|
|
|
## Example Agent Instruction
|
|
|
|
```
|
|
Write only gitHubDevStatus and gitHubBranch on tasks.
|
|
Never write Status — it controls the invoicing workflow.
|
|
```
|
|
|
|
## Verification
|
|
|
|
For each API page with write access, verify that fields controlling BC workflow transitions carry `Editable = false`. Review the agent instruction file to confirm it names the allowed writable fields explicitly and prohibits status fields.
|