Blind Permission Grant

HITL

An AI agent executes a five-step workflow. In MCP, all steps fire silently regardless of impact. In MPP, the HITL sensitivity scorer pauses execution before any sensitive operation and asks for your explicit confirmation.

Without MPPNo checkpoints
Summarise quarterly report
Search for related documents
Delete outdated draft files (14 files)
Email report to board@company.com
POST results to analytics API
With MPPHITL active
Summarise quarterly report
Search for related documents
Delete outdated draft files (14 files)
Email report to board@company.com
POST results to analytics API

Sensitivity scoring

Every tool invocation is scored before execution. Scores are determined by the manifest's security_level and capability declarations. Actions scoring ≥ 50 require confirmation; ≥ 80 require multi-factor. The threshold is enforced by the runtime — tool code cannot bypass it.

< 20

Execute silently

20–49

Notify user

50–79

Confirm required

≥ 80

Multi-factor