Cryptic Developers · Engineering notes
Define the vocabulary
Start with a small list of operations the interface can perform. Give each operation validated inputs and a real component or service that owns it. Do not turn generated text into a CSS selector, a shell command or an arbitrary network request.
Keep permissions outside the model
A persuasive response is not an authorisation decision. OWASP recommends default denial and permission checks on every protected request. Apply that rule when an assistant requests an operation, just as when a visitor presses a button.
Confirm the result
Requesting an operation and completing it are different states. A navigation tool should confirm that the intended component opened. A business operation needs an authoritative service result. Show failure honestly and preserve a useful manual path.
Evaluate the boundary
Test unknown actions, malformed arguments, unavailable resources and interrupted requests. Useful evaluation includes what the system refuses, not only the examples it handles successfully. Keep the action vocabulary narrow enough to inspect and maintain.