A2UI production security checklist
A2UI reduces the risk of executing agent-generated code, but it does not make model output trusted. Treat every remote message, property, URL, action, and data-model update as untrusted input.
Before rendering
- Negotiate the protocol version and reject unsupported envelopes.
- Validate messages against the exact versioned schema.
- Allow only registered catalogs and components.
- Set maximum message size, component count, tree depth, list size, and update frequency.
- Reject duplicate IDs, unresolved children, invalid paths, and unexpected properties.
- Block prototype-bearing path segments such as
__proto__,constructor, andprototype.
Component policy
- Resolve links through an allowlisted URL handler; permit only required schemes and prefer HTTPS.
- Treat iframe, WebView, raw Markdown/HTML, media, file download, clipboard, navigation, and payment components as elevated capabilities.
- Sanitize rendered Markdown and never enable raw HTML by default.
- Keep secrets, access tokens, session identifiers, and private prompts out of component props and the data model.
- Label external or remote content so users can distinguish it from trusted host UI.
Actions and high-impact decisions
- Authorize every action on the server; a disabled button is not an access-control boundary.
- Bind actions to stable IDs and validate context against current server state.
- Require explicit confirmation for deletion, publication, account changes, purchases, payments, and disclosure of sensitive data.
- Make retry semantics idempotent for high-impact operations.
- Record the agent, catalog, surface, action, user, decision, and result in audit logs without logging secrets.
Privacy and YMYL
- Minimize personal data sent to the model and renderer.
- State when health, legal, financial, or safety content is informational and route consequential decisions to qualified review.
- Do not let generated UI imply a diagnosis, guaranteed return, legal conclusion, or completed transaction without authoritative confirmation.
- Provide a path to inspect, correct, export, and delete user-supplied data where applicable.
Accessibility and resilience
- Preserve semantic roles, names, focus order, keyboard operation, and live-region announcements.
- Never rely on color alone for status or validation.
- Honor reduced-motion and contrast preferences.
- Provide text fallback for unsupported components and renderer failure.
- Test slow streams, partial payloads, reconnects, duplicate delivery, stale actions, and agent timeouts.
Security evidence
The official web core has shipped fixes for URL-opening XSS/tab-nabbing and DataModel prototype pollution. These fixes demonstrate why declarative UI still requires implementation hardening and current dependencies.
This checklist is engineering guidance, not a substitute for a security assessment or legal review.