MolTrust has written the clearest explanation yet of why a prompt is not a control. In Amazon Ads MCP Server guardrails, the post opens with the thesis: “A limit in an agent’s system prompt is a request to the model. A check on each Amazon Ads MCP tool call, against a mandate per ad account, stops a bad change before it runs.” Amazon’s Ads MCP Server gives an agent 110 documented tools in 18 groups, and limits such as “never set a daily budget above 500” usually live in the prompt, “text the model reads before it acts,” with nothing between the model and Amazon that checks the call that comes out.
The figures about Amazon’s server come from Amazon’s documentation and are cited as such: a beta from February, OAuth 2.1 since July, a Lite endpoint since September, and write tools that take lists, so “a single call can change many campaigns at once.” The post names four mistakes “that happen with a model that is trying to follow its prompt”: a typo that writes 5,000 for 500, an ID from another client’s list, delete_campaign called when asked to pause, and an instruction hidden in a product title. “A sentence in the prompt cannot stop any of these.” Its answer is a written mandate per account, naming permitted tools, accounts, budget and bid caps and an approval threshold, with three outcomes, allow, hold for a named person, or forbid. Batch calls are split and the strictest item decides; unknown values are forbidden; the check “fails closed”; and tools that change who can act on an account “should not be grantable at all.” MolTrust sells the check, and says so with code.
The catalog holds MolTrust as one of the more agent-shaped records it has. The MolTrust provider page lists 63 API pages, and the mandate check the post describes runs through the MolTrust AAE Enforcement API, with the company’s own MolTrust MCP Server alongside. The agentic access profile maps 257 operations, 101 of them acting and 6 human-in-the-loop. The MCP server, agent skills, the agent card, reversibility and the event surface are lit.
The Kin Score is 63.8, strong band, with access clarity at 84.2 and discoverability at 80.0 against contract governance at 18.2. The Agent Readiness score is 44.2, agent-ready. The post argues for a check that sits outside the model, and the catalog measures the contract-level forms of that idea: dry-run mode, a way to rehearse a call, and idempotency, a way to retry one safely. Both are unlit on MolTrust’s own record, as is delegated identity. MolTrust has described exactly why a policy has to run on the call and not in the prompt. Its own API is the place to show the same discipline in the contract.