Blind Permission Grant
HITLAn AI agent executes a five-step workflow. In MCP, all steps fire silently regardless of impact. In MPP, the HITL sensitivity scorer pauses execution before any sensitive operation and asks for your explicit confirmation.
Without MPPNo checkpoints
Summarise quarterly report
Search for related documents
Delete outdated draft files (14 files)
Email report to board@company.com
POST results to analytics API
With MPPHITL active
Summarise quarterly report
Search for related documents
Delete outdated draft files (14 files)
Email report to board@company.com
POST results to analytics API
Sensitivity scoring
Every tool invocation is scored before execution. Scores are determined by the manifest's security_level and capability declarations. Actions scoring ≥ 50 require confirmation; ≥ 80 require multi-factor. The threshold is enforced by the runtime — tool code cannot bypass it.
< 20
Execute silently
20–49
Notify user
50–79
Confirm required
≥ 80
Multi-factor