Module 1.3 — Cross-Origin and Permissions

Map who speaks for whom

What it is: The page, agent, user, and backend have different identities and authorities.

Why learn: Confusing these identities creates excessive delegation and authorization bugs.

Before modeling

Write the person’s request, the current state, and the evidence that will prove completion.

Starting error

Starting with a function name or a button produces a tool without a clear human goal.

Predict before opening the code

What information changes the decision? What effect needs to appear in the interface? Answer before implementing.

actor: userSession.id
agent: browserAgent.instanceId
origin: location.origin
resource: "enrollments"

Going deeper: evidence worth keeping

Record the input, previous state, decision made, result, and visible change to the page.

Also include an induced failure and the observed behavior without WebMCP support.

Key concepts

principal

delegation

session

resource

Use the same-origin policy

What it is: Origin combines scheme, host, and port and defines a central boundary of the Web.

Why learn: A tool registered by a document doesn’t grant unrestricted access to other origins.

Question	Strong contract	Weak contract
When should you use it?	The description names the intent and context.	“Does things” or “manages.”
What does it receive?	Only the data you need.	Generic and unlimited object.
What does it return?	Verifiable state and next action.	Text without a protocol.
How does it fail?	Code, rationale, and recovery.	Opaque exception.

Do it

✓ Use specific verbs.
✓ Define the inputs.
✓ State the evidence.

Avoid

✗ Mix intentions.
✗ Accept any object.
✗ Hide effects.

const lifecycle = new AbortController();

await document.modelContext.registerTool(tool, {
  exposedTo: ["https://agent.example"],
  signal: lifecycle.signal
});

// Same-origin é o padrão. Cross-origin exige origem explícita e confiável.

Three different controls

exposedTo selects origins authorized to discover the tool; the Permissions Policy tools controls delegation in the document; the backend still authenticates the person and authorizes each effect.

Going deeper: evidence worth keeping

Record the input, previous state, decision made, result, and visible change to the page.

Also include an induced failure and the observed behavior without WebMCP support.

Key concepts

same-origin

scheme

host

port

Treat the iframe as a boundary

What it is: Embedded frames have their own document, origin, and lifecycle.

Why learn: The agent needs to know which context provides the tool and where its effect will be visible.

Observe

Capture state, input, and context before taking action.

Decide

Validate preconditions and choose the allowed transition.

Execute

Apply the shared rule and respect cancellation.

Prove

Update the interface and return a structured result.

Checkpoint

If step 2 fails, the tool doesn’t try to “make it work”: it returns an explicit recovery.

const tools = await document.modelContext.getTools({
  fromOrigins: ["https://agent.example"]
});
const selected = tools.find((tool) => tool.name === "buscar_cursos");

// RegisteredTool preserva origem e Window do contexto registrador.
assertTrusted(selected.origin);
runOnlyWhileConnected(selected.window);

Going deeper: evidence worth keeping

Record the input, previous state, decision made, result, and visible change to the page.

Also include an induced failure and the observed behavior without WebMCP support.

Key concepts

top frame

iframe

sandbox

context id

Don't turn CORS into authorization

What it is: CORS controls reading by browser scripts; the backend still validates identity and permission.

Why learn: A response allowed by CORS may still be forbidden for that user and operation.

REFERENCE CODE

fetch(api, { credentials: "include", signal });
// servidor valida sessão, escopo e CSRF

Input

It is small, described, and validatable.

Execution

Reuses the application's actual rule.

Output

Allows you to verify the effect and continue.

Read the code as a contract

Underline where input is validated, where the effect occurs, where cancellation arrives, and where the UI is updated.

Going deeper: evidence worth keeping

Record the input, previous state, decision made, result, and visible change to the page.

Also include an induced failure and the observed behavior without WebMCP support.

Key concepts

CORS

credentials

backend auth

CSRF

Request proportionate consent

What it is: Sensitive actions require clear confirmation that shows the target, effect, and reversibility.

Why learn: Generic or advance consent doesn’t cover a specific mutation.

Induced failure

Run the scenario with missing state, invalid input, or unavailable capability.

Expected recovery

The response explains what failed, what remains safe, and what action can continue.

Minimum test matrix

✓ reproducible happy path

✓ actionable invalid input

✓ cancellation ends the work

✓ fallback preserves the user journey

✓ interface reflects the state

✓ backend maintains authorization

confirm({ action: "cancelar inscrição", target: enrollmentId, reversible: false });

Going deeper: evidence worth keeping

Record the input, previous state, decision made, result, and visible change to the page.

Also include an induced failure and the observed behavior without WebMCP support.

Key concepts

just in time

effect

target

reversibility

Test cross-context attacks

What it is: The suite covers tool spoofing, navigation during execution, a removed frame, and an unexpected origin response.

Why learn: Boundaries only truly exist when adversarial paths are exercised.

Synthesis exercise

1. Explain the problem without using the name of the technology.
2. Design the before and after states.
3. Implement the smallest functional proof.
4. Trigger a failure and record the recovery.
5. Deliver code, evidence, and a known limitation.

Module challenge

Design an authority matrix for an agent that navigates a public catalog, an authenticated area, and an external service.

Responsible Agent Developer criterion

The deliverable must work, explain its limitations, and preserve the human path when the experimental capability is unavailable.

esperado: rejeitar resultado quando responseOrigin !== registeredOrigin

Going deeper: evidence worth keeping

Record the input, previous state, decision made, result, and visible change to the page.

Also include an induced failure and the observed behavior without WebMCP support.

Key concepts

spoofing

navigation race

frame removal

origin check

📦 Module delivery

Design an authority matrix for an agent that navigates a public catalog, an authenticated area, and an external service.

Acceptance criteria

The deliverable works with WebMCP support and preserves the manual path when the API is unavailable.

Evidence

Include code, a tested scenario, the observed result, and a known limitation.

← Back to the track Next module: 1.4 →

Technical sources

WebMCP draft and official repository
Rendered specification
Official snapshot: 26/08/2026 · commit 41d12f0. The declarative API remains experimental; validate the draft before production.