Prompt / Agent Configuration

Configuration identity and addressing

The identifiers by which this configuration is known: the master-system identifier of record, an ownership-bearing namespaced name, and any unstable display aliases. MCP names are unique only within a server, so they are not global identifiers.

1. Which authoritative master system issues the identifier for this configuration, and what is that identifier? identity
2. What governed namespace or reverse-DNS name distinguishes this configuration from a same-named configuration published by someone else? interoperability
3. Is this a system instruction, a parameterised prompt template, an agent definition, a tool-grant set, or a composite of these? classification
4. Which display titles, slugs or aliases resolve to this configuration, and which of them are guaranteed stable? definition

Revision integrity and content address

Each released revision is an immutable snapshot identified by an algorithm-qualified digest over a canonical serialisation, with run-time-resolved regions explicitly excluded.

1. What algorithm-qualified digest identifies the exact content of this configuration revision? evidence
2. Which canonical serialisation was digested so the same logical configuration yields the same digest in any store? validation
3. Which regions are excluded from the digest because they resolve only at run time? composition

Configuration kind and intended use

Configurations are not one kind. ISO 22989 treats prompt as overarching generative-AI instructions that may be fixed or editable. MCP treats prompts as user-selected templates and tools as model-controlled functions. OpenAI packages instructions, tools, model settings, guardrails, and handoffs as an agent. Agent Skills packages task expertise separately from the host agent. Classification must record kind, intended task, and whether the payload is public discovery or operational instruction.

1. Is this payload an instruction stack, a user-selectable prompt template, a skill package, a tool catalog binding, a stored-prompt reference, or a composite agent configuration? classification
2. What intended purpose, user population, and prohibited uses bound this configuration? definition
3. Is the prompt fixed by the deployer, editable by operators, or dynamically generated per request, and who may edit it? state
4. Which fields may appear on a public discovery card versus remaining in the operational instruction body? classification

Version scheme and compatibility

Which version scheme applies, which change classes are breaking for a configuration (authority, grants, output contract, safety constraints), and which interface revisions are declared compatible. Interface revision and artifact version are separate axes.

1. Which version scheme governs this configuration and what change classes force a major increment? classification
2. Which consumers pin this configuration by exact revision rather than by a version range? relationship
3. Which protocol or interface revisions does this configuration declare itself compatible with? interoperability
4. May a released version be edited in place, and if not, how are corrections issued? constraint

Lifecycle states and change control

The state a revision occupies, the transitions permitted, the approval evidence required to promote it, and the separately recorded instants of authoring, approval, release and withdrawal.

1. What lifecycle state is this revision in and which states are reachable from it? state
2. Who must approve promotion to production and on what evidence? decision
3. When was this revision authored, approved, released and withdrawn, each recorded as a separate instant? temporal
4. What notice period applies before this configuration is withdrawn from service? lifecycle

External schema alignment and conflicts

This model aligns to ISO 22989 prompt, MCP tools and prompts, A2A AgentSkill, Agent Skills, OpenTelemetry gen_ai.prompt.* and generation attributes, and vendor agent objects. Alignments are not conformance claims. Known conflicts include MCP user-controlled prompts versus developer system instructions, OpenAI provider-system versus industry system-message, OTel date-like version examples, and OpenAI migration away from hosted prompt objects.

1. Which external schemas is this configuration mapped to, and with what field-level mapping evidence? interoperability
2. Is any conformance to MCP, A2A, Agent Skills, or OTel actually claimed, and what test evidence supports it? evidence
3. Which recorded conflicts (prompt control, system-layer meaning, version-as-date, hosted versus repo prompts) affect this instance? decision
4. Which storage or interface projection carries this instance, without treating that projection as the semantic model? interoperability

Instruction blocks, arguments and rendering

The discrete blocks that make up the instruction payload, their roles and ordering, the named arguments a template accepts, the substitution step that produces final messages, and the escaping that keeps argument values from being read as instructions.

1. Which discrete instruction blocks make up this configuration and what role does each carry? composition
2. Which block is delivered to the model as the system or developer instruction before any user input? definition
3. Which named arguments does this template accept and which of them are required? requirement
4. What rendering or substitution step turns the template plus arguments into the final message sequence? process
5. What happens when a required argument is missing or fails schema validation? exception

Composition, overlays and precedence

How this configuration imports or overrides bases, which file wins when several apply to the same working scope, which fragments are shared with other configurations, and how locale or tenant variants are selected.

1. Which parent or base configurations does this revision import, extend or override? composition
2. When more than one configuration applies to the same working scope, which one wins? constraint
3. Which fragments are shared with other configurations and therefore change together? relationship
4. Which locale, tenant or channel variants exist and how is one selected at run time? classification

Skill packages and progressive disclosure

A skill is a directory with SKILL.md frontmatter (name, description, optional license, compatibility, metadata, experimental allowed-tools) plus optional scripts, references, and assets. Agents load name and description first, then the instruction body on activation, then referenced files on demand. Name must match the directory. This is operational instruction packaging, not the knowledge corpus of the references themselves.

1. What skill name, description, license, compatibility, and directory identity uniquely identify each bound skill version? identity
2. Under what conditions is a skill activated, and which instruction body, scripts, and references may then load? process
3. Does the skill declare experimental allowed-tools, and how is that reconciled with the host configuration allowlist? constraint
4. Was the skill validated against naming and frontmatter rules, and what validator and result apply? validation

Instruction authority hierarchy

The authority level each block occupies relative to platform, developer and user instructions, which instructions an end user may override, and how equal-authority conflicts resolve. Higher authority overrides lower; developer configuration cannot override platform-level rules.

1. At which authority level does each instruction block sit relative to platform, developer and user instructions? authority
2. Which instructions may an end user override and which are non-negotiable for this deployment? constraint
3. How is a conflict between two instructions of equal authority resolved? decision

Untrusted content boundary and injection defence

Which inbound channels carry no instruction authority, how such content is delimited, what injection testing evidence exists for this revision, and what the runtime does on detection. Tool outputs, retrieved documents and attachments have no authority by default.

1. Which inbound content channels are declared untrusted and stripped of instruction authority? security
2. What structural markers separate retrieved or tool-returned content from configuration instructions? constraint
3. What evidence shows this revision was tested against direct and indirect prompt injection? evidence
4. What does the runtime do when injected instructions are detected mid-run? event

Model selection and preferences

Which model and provider the configuration is pinned to, or the abstract capability priorities and hints used when no exact model is pinned, and what must be re-validated when the model changes beneath a pinned configuration.

1. Which model and provider is this configuration pinned to, if any? identity
2. If no exact model is pinned, which capability priorities and hints drive selection? decision
3. What must be re-validated when the underlying model changes beneath a pinned configuration? validation

Generation parameters and output contract

The decoding parameters the configuration sets, which of them a runtime may silently ignore or clamp, the required output shape, and the schema dialect that governs it.

1. Which decoding parameters are set and what value does each take? measurement
2. Which of these parameters may the runtime silently ignore, clamp or reject? exception
3. What output format does this configuration require and is it enforced by a schema? requirement
4. Which schema dialect governs the declared output structure? interoperability

Structured outputs, modalities and handoffs

A2A Agent Cards declare default input and output MIME types and skills with examples. OpenAI agents add structured outputs and handoffs with handoffDescription. Configuration must state the output contract and which specialist configurations may be delegated to, without absorbing those specialists' identities.

1. What structured-output schema or MIME types must responses satisfy, and what happens on violation? constraint
2. Which default input and output modalities are enabled, and which are overridden per skill? classification
3. Which other configurations or agents may be handed off to, with what descriptions and constraints? relationship
4. Which skills are advertised on a discovery card versus only available inside this operational configuration? interoperability

Tool grants and schema binding

The named tools the configuration may call, the server each comes from, the input and output schema digests bound at release, disambiguation of colliding names across servers, and explicit denials.

1. Which named tools may this configuration call and from which server does each come? access
2. Which input and output schemas were bound to each granted tool at release time? composition
3. How are collisions between identically named tools from different servers disambiguated? interoperability
4. Which tools are explicitly denied even when the runtime offers them? constraint

Tool risk annotations and confirmation gates

The behaviour hints attached to granted tools, the basis on which the supplying server is trusted, which calls require human confirmation, and per-tool invocation limits. Annotations must be treated as untrusted unless the server is trusted.

1. Which granted tools are annotated read-only, destructive, idempotent or open-world? classification
2. On what basis is the server supplying those annotations treated as trusted? quality
3. Which tool calls require explicit human confirmation before execution? authority
4. What invocation or rate limits apply per tool under this configuration? measurement

Context, resource and memory grants

Which resources, roots and knowledge collections may enter context, what context-inclusion mode applies and whether the runtime may narrow it for privacy, and which persistent memory stores the configuration may write to.

1. Which resources, roots or knowledge collections may be read into context? access
2. What context-inclusion mode applies and may the runtime narrow it for privacy reasons? privacy
3. Which persistent memory stores may this configuration write to and with what scope? retention

Server bindings and authorization scope

Which servers the configuration binds to and over which transport, which scopes it requests and what justifies each, how credentials are referenced without being embedded, and what happens when a bound server changes its tool list after release.

1. Which servers does this configuration bind to, at what endpoint and over which transport? relationship
2. Which authorization scopes are requested and which declared capability justifies each one? authority
3. How are credentials referenced without being embedded in instruction text? security
4. What happens when a bound server changes its tool list after this revision was released? event

Behavioural constraints, enforcement and refusals

The behaviours the configuration requires, forbids or conditions; which of them are enforced outside the model at the application or policy layer; and the specified refusal or safe-completion behaviour for out-of-scope requests.

1. Which behaviours does this configuration require, forbid or make conditional? constraint
2. Which of those constraints are enforced outside the model rather than by instruction text alone? requirement
3. What refusal or safe-completion behaviour is specified for out-of-scope requests? process

Secret hygiene and prompt leakage exposure

Whether any instruction block contains a secret, the declared impact of full instruction disclosure, and the independent output inspection that verifies compliance instead of relying on the prompt.

1. Does any instruction block contain a secret, credential or connection string? security
2. What is the declared impact if the full instruction text is disclosed to an end user? privacy
3. Which independent output inspection verifies compliance instead of relying on the prompt? validation

Human oversight and approval gates

Actions requiring a human able to deny them, the information the reviewer must be shown before deciding, the competence and empowerment of the intervening role, and how overrides and denials are recorded.

1. Which actions require a human in the loop able to deny them? authority
2. What must be shown to the reviewer before an approval decision is taken? requirement
3. Which role is competent and empowered to intervene, and how is that competence assured? ownership
4. How is an override, edit or denial recorded? event

Autonomy limits and resource budgets

The maximum autonomous steps or tool-loop iterations, the token, cost and wall-clock budget bounding a single run, and what terminates an over-budget run and in what state.

1. What is the maximum number of autonomous steps or tool-loop iterations permitted? constraint
2. What token, cost and wall-clock budget bounds a single run under this configuration? measurement
3. What terminates a run that exceeds its budget and what state is left behind? state

Evaluation suites and acceptance criteria

Which suites were run against the exact revision digest, what thresholds gated release, which model build and runtime were used, and how long the evidence stays valid.

1. Which evaluation suites were run against this exact revision digest? evidence
2. What acceptance thresholds had to be met before release was permitted? measurement
3. Which model build and runtime version were used during evaluation? provenance
4. How long does this evaluation evidence remain valid before it must be repeated? temporal

Adversarial testing evidence

Red-team and adversarial testing performed against the configuration, the attack classes explicitly excluded, and the open findings with their accepted residual risk.

1. What adversarial or red-team testing was performed against this configuration? evidence
2. Which attack classes were explicitly out of scope for that testing? exception
3. Which findings remain open at release and who accepted the residual risk? decision

Authorship and provenance chain

The agents that authored or revised the configuration and on whose behalf they acted, the generating activity and prior entity it derived from, whether any part was machine-generated, and the separation of activity time from record ingestion time.

1. Which agents authored or revised this configuration and on whose behalf did they act? provenance
2. Which activity generated this revision and from which prior entity was it derived? relationship
3. Was any part of this configuration machine-generated, and by which system? quality
4. When did the authoring activity start and end, as distinct from when the record was ingested? temporal

Release attestation and dependency inventory

The signed statement binding a builder identity to the revision digest, the external parameters and resolved dependencies that produced it, the inventory of models, datasets, tools and third-party prompt components, and the consumer-side verification procedure.

1. Which signed attestation binds a builder identity to this revision digest? evidence
2. Which external parameters and resolved dependencies produced the released artifact? composition
3. Which models, datasets, tools and third-party prompt components does this configuration depend on? interoperability
4. How does a consumer verify the attestation before loading the configuration? validation

Environment binding, rollout and rollback

Which environments and tenants run this revision, the rollout strategy and traffic share, the effective-from and effective-to window per environment, the designated rollback target, and the mechanism that disables the configuration immediately without a redeploy.

1. In which environments and tenants is this revision currently active? state
2. What rollout strategy governs exposure and what share of traffic sees this revision? process
3. From when until when was this revision effective in each environment? temporal
4. Which prior revision is the designated rollback target? decision
5. What mechanism disables this configuration immediately without a redeploy? exception

Run linkage and telemetry contract

Which telemetry attribute carries the exact revision used by a run, whether instruction text is captured and under what opt-in and redaction rules, and how long run records are kept so the link survives.

1. Which telemetry attribute carries the exact configuration revision used by a run? interoperability
2. Are instruction texts recorded in telemetry, and under what opt-in and redaction rules? privacy
3. How long are run records kept so a run can still be traced back to its configuration? retention

Ownership and accountable roles

Who owns the configuration, who is the accountable deployer, which organisational AI inventory entry records it, and how authoring and approval duties are separated.

1. Who owns this configuration and who is the accountable deployer? ownership
2. Which entry in the organisational AI system inventory records this configuration? identity
3. Which duties are separated so that the author is not the sole approver? authority

Regulatory classification and documentation duties

Whether the system driven by this configuration falls into a regulated risk class, which technical-documentation elements must record the key design choices captured here, and which jurisdictions and effective dates apply.

1. Does the system driven by this configuration fall into a regulated risk class in any applicable jurisdiction? classification
2. Which technical-documentation elements must record the key design choices captured here? requirement
3. Which jurisdictions and effective dates apply to those duties? spatial

Confidentiality classification and access rights

The confidentiality class of the instruction text, which principals may read, propose, approve or publish, which fields must be redacted before disclosure, and what is logged on read or export. Confidentiality is a handling class, never a security control.

1. What confidentiality class applies to the instruction text of this configuration? access
2. Which principals may read, propose, approve or publish revisions of it? authority
3. Which fields must be redacted before the configuration is shared with a deployer or auditor? privacy
4. What is logged whenever the configuration is read or exported? security

Retention, deletion and legal hold

How long superseded revisions must be retained for audit and reproducibility, what deletion does and what tombstone survives it, and which holds override the normal period.

1. How long must superseded revisions be retained to support audit and reproducibility? retention
2. What deletes a revision and what tombstone survives deletion? lifecycle
3. Which legal hold or regulatory minimum overrides the normal retention period? exception