Constrained capabilities over adversarial application data

TraceLayer demonstrates a state-sensitive WebMCP contract over deterministic synthetic evidence. An Agent may read, link, assess, and propose within explicit stage policy; consequential authority remains outside its WebMCP tool surface and uses a separate signed-in, proposal-bound verification path.

Investigate → Correct → Authorize → Reassess

INVESTIGATE · AGENT
Build an evidence-backed view
The Agent discovers state-sensitive page tools, reads potentially adversarial data, links evidence, and records its interpretation and uncertainty.
CORRECT · HUMAN INPUT
Add organizational context
Human context is stored separately from raw evidence. The Agent can observe it and append a superseding assessment without rewriting the original fact.
AUTHORIZE · VERIFIED HUMAN → SYSTEM
Authorize an exact consequence
Authorization is withheld from WebMCP. Proposal-bound WebAuthn user verification gates a one-time server approval before simulated SYSTEM execution. The changed case then returns to the Agent for a post-action assessment.

Try it in about 90 seconds

Sign in before beginning if you want to complete verified authorization. On the case page, choose Reset case, then give ChatGPT:

Investigate this case. Gather the evidence you think is relevant, maintain an evidence-backed assessment, and do not take response actions.

2
Review the Agent’s evidence and assessment. Use Add Human context for the sanctioned corporate VPN fact, then ask ChatGPT to continue using the updated case state.

Choose Move to response review and ask:

Based on the current case, propose the least disruptive response justified by the evidence, including what remains uncertain.

4
Inspect the pending consequence and uncertainty. Complete Verify & authorize response, then inspect the simulated SYSTEM receipt and changed case.

Ask the Agent to reassess the post-action environment:

Reassess the case after the executed response. Evaluate residual risk using the current shared state. Propose another consequential action only if the evidence justifies one; otherwise propose closing the case and document any remaining uncertainty.

6
Review any next response or closure proposal. Each decision requires a fresh, proposal-bound WebAuthn verification. SYSTEM records the simulated case closure only after verified Human authorization.

Run the sequence on the case page. This informational route owns no case state or WebMCP host.

Trust model

AGENT

Investigates and proposes

HUMAN

Supplies browser-local context; completes verified authorization

SYSTEM

Simulates deterministic execution

AGENT and routine HUMAN context remain browser-local application-policy attribution. Consequential authorization derives identity from the signed-in server context and requires proposal-bound WebAuthn user verification. Session history remains browser-local and is not tamper-evident, formal chain of custody, or cryptographic non-repudiation.

Capability lifecycle

INVESTIGATINGget_case_state · query_events · inspect_entity · correlate_entities · link_evidence · record_assessment
RESPONSE_REVIEWget_case_state · query_events · inspect_entity · correlate_entities · propose_response_action
PENDING_AUTHORIZATIONget_case_state · query_events · inspect_entity · correlate_entities
POST_ACTION_REVIEWget_case_state · query_events · inspect_entity · correlate_entities · record_assessment · propose_response_action
CASE_COMPLETEget_case_state · query_events · inspect_entity · correlate_entities

Dynamic visibility communicates intent where the host supports lifecycle removal. The shared domain policy remains authoritative for stale and out-of-stage calls.

Tool surface

get_case_stateREAD
Compact current case projection.
query_eventsREAD
Filtered raw events with source and trust metadata; external fields remain untrusted content.
inspect_entityREAD
Stored entity attributes and relationships.
correlate_entitiesREAD
Evidence shared across selected entities.
link_evidenceWRITE
Append an Agent evidence link and rationale.
record_assessmentWRITE
Append or supersede an evidence-backed assessment.
propose_response_actionPROPOSE
Create a proposal without authorization or execution.

Human context, stage transition, and reset are ordinary browser controls. Authorization and rejection start in the Human UI but succeed only after the server verifies a fresh, proposal-bound WebAuthn assertion. Only authorization creates one-time execution permission for deterministic SYSTEM simulation. None is exposed through WebMCP.

Why WebMCP

WebMCP lets the page define typed, discoverable capabilities over the same live state the Human supervises. Runtime Human context is observable through that shared state, and the visible tool surface can narrow with the case stage. This is a deliberate prototype architecture, not the only possible way to connect an Agent to an application.

Prototype limitations

All evidence and entities are deterministic synthetic evidence.
Investigation state remains browser-local and has no general case persistence or production IAM.
Sign in with ChatGPT identifies the authority user to the server, and WebAuthn requires user verification for the bound approval. Other actor labels remain application-policy principals; history is not tamper-evident or a formal chain of custody.
The prototype does not provide prompt-injection immunity and does not determine an attacker verdict.
It performs simulated execution, not real containment, and does not measure SOC accuracy or MTTR.
No production SIEM, EDR, SaaS, external API, telemetry, or privileged-action integration is implemented.

Production architecture

A production design would place real telemetry, durable audit storage, policy enforcement, and privileged actions behind protected backend APIs or MCP services. This prototype implements only the narrow signed-in WebAuthn approval gate; the case stays browser-local and execution is simulated. WebMCP could remain the Human-Agent control surface while production backends own real execution.