Unverified50% confidenceCautionExact time
Secure design should approve read-only issue queries without enabling repository write permissions, and servers should not be allowed to modify tools, databases, or applications.
1
Sources
50%
Confidence
Long-term
Relevance
10/8/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedSensitive parameters such as merchant numbers and keys should be placed only in configuration files and not written into business code, in order to protect information security.70% similarUnverified一个负责回复邮件的Agent不应拥有删除数据库的权限，通过限制工具访问范围可将出错破坏压缩到最小69% similarUnverifiedPage content must be marked as untrusted; observation results can only provide data and cannot grant permissions, change approvals, or override user tasks, in order to defend against prompt injection attacks.69% similarUnverifiedThe instructor recommends enforcing server identity at the registry level (registry-only) and not using allow all, because allow all makes it impossible to trace which tools the Agent has called.67% similarUnverifiedThe correct approach is to keep sensitive configurations on the server side and dynamically deliver only the content required based on user permissions67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/987534API
curl https://kongchang.com/api/v1/knowledge/claims/987534MCP
get_claim(id=987534)