Repository navigation
Privacy policy: two sentences go stale once writes fetch the app's origin #174
Description
Split out of #166 so that PR isn't held on legally reviewed text. Raised there by @aterga (open question 3) and independently by Copilot.
Since #166, canister_update_call fetches the app's origin on every write — it reads /.well-known/ic-architecture to decide whether the app declares the target canister, and resolves /.well-known/ii-derivation-origin to bind the identity. Two sentences in the policy predate that:
-
"Websites you ask the Service to look up." — currently scoped to "when you ask it to find the application behind a web address". The Service now also contacts the app's site when you act on it, which discloses the request to whoever runs that site. The trigger needs to widen from look up to look up, or act on.
-
"The authorization is not restricted to particular applications." — still true of the credential (a per-app identity is derived for whichever application is named), but a reader will take it to mean the assistant can act at any application. It can't: actions now reach only apps publishing the standard manifest, and only under that app's own identity.
Two copies to keep in sync since #165:
docs/icp-mcp-privacy-policy-draft.md(lines ~192-194 for the first sentence)dfinity/internetcomputer-org→public/icp-mcp/privacy-policy/index.html(the served page)
Both are legally reviewed, so this needs legal, not a drive-by edit.
Activity
aterga commentedon Sep 1, 2026
Closing per the release drift-report action. Both sentences are updated in the source text by #177, and the doc header now flags them as pending legal review so the draft cannot silently flow to the served page:
"Websites you ask the Service to look up." → "Websites you ask the Service to look up, or act on." — the paragraph now says the Service fetches metadata both when resolving an app and when acting at one (the app's published service declarations and identity configuration, read before the action is submitted), which discloses the request to whoever runs that site. That is Restrict update calls to canisters an app declares (service discoverability) #166's behaviour stated for users.
"The authorization is not restricted to particular applications." — kept, since it is true of the credential, and immediately qualified: the sentence block now states that a state-changing action reaches only an application whose operator has published the standard declaration, and is signed with the identity derived for that application alone, so the credential's breadth is no longer readable as "the assistant can act anywhere".
Remaining, deliberately outside this repo and gated in the doc header:
public/icp-mcp/privacy-policy/index.html).One more heads-up for whoever does the sync: the policy draft's header also gained a hosting-model note (see #122's closing comment and #176) — worth folding both into one legal pass and one republication.
Generated by Claude Code
Reconcile privacy and submission evidence with the deployed state (#177)