Security Model

Tessera Agent treats every model proposal as untrusted data. Declarative output is useful only after the server compiler and Host authority commit it.

• The model cannot generate HTML, JSX, JavaScript, CSS, SQL, formulas, URLs, component names, tool names, credentials, or executable handlers.
• Every node pins an exact immutable Component Contract from the frozen CatalogSetSlice; unknown or substituted contracts fail closed.
• Query rows stay in the grant-bound Resource Gateway. They do not enter model context, proposals, canonical documents, revision history, or ordinary logs.
• Browser code receives trusted Surface events and node-scoped resolved projections, never database credentials or raw tool payloads.
• Preview nodes are read-only. Only committed projections may emit a declared event port.
• SurfaceController checks session identity, audience binding, sequence, revision, node scope, event schema, state preconditions, and resource versions.
• The server owns authorization, approvals, idempotency, effects, receipts, persistence, and resume cursors.
• A renderer error is isolated to one node and cannot change the canonical revision or execute an effect.

Unknown contracts, invalid placement, unresolved props, malformed events, expired grants, stale revisions, replayed approvals, and stream identity mismatches are explicit failures. Last-good committed content remains available while the Host requests resynchronization or shows a trusted system surface.

Open-ended mini-apps belong in a separate sandbox or MCP App boundary. They are not a reason to weaken the trusted Tessera Agent catalog.