Skip to content
On this page

A2UI Production Security Checklist

A practical security, privacy, accessibility, and resilience checklist for rendering untrusted agent-generated interfaces.

Updated: 8/6/2026 Reviewed by: HiA2UI Editorial Team A2UI v0.9.1 production baseline

A2UI production security checklist

A2UI reduces the risk of executing agent-generated code, but it does not make model output trusted. Treat every remote message, property, URL, action, and data-model update as untrusted input.

Before rendering

  • Negotiate the protocol version and reject unsupported envelopes.
  • Validate messages against the exact versioned schema.
  • Allow only registered catalogs and components.
  • Set maximum message size, component count, tree depth, list size, and update frequency.
  • Reject duplicate IDs, unresolved children, invalid paths, and unexpected properties.
  • Block prototype-bearing path segments such as __proto__, constructor, and prototype.

Component policy

  • Resolve links through an allowlisted URL handler; permit only required schemes and prefer HTTPS.
  • Treat iframe, WebView, raw Markdown/HTML, media, file download, clipboard, navigation, and payment components as elevated capabilities.
  • Sanitize rendered Markdown and never enable raw HTML by default.
  • Keep secrets, access tokens, session identifiers, and private prompts out of component props and the data model.
  • Label external or remote content so users can distinguish it from trusted host UI.

Actions and high-impact decisions

  • Authorize every action on the server; a disabled button is not an access-control boundary.
  • Bind actions to stable IDs and validate context against current server state.
  • Require explicit confirmation for deletion, publication, account changes, purchases, payments, and disclosure of sensitive data.
  • Make retry semantics idempotent for high-impact operations.
  • Record the agent, catalog, surface, action, user, decision, and result in audit logs without logging secrets.

Privacy and YMYL

  • Minimize personal data sent to the model and renderer.
  • State when health, legal, financial, or safety content is informational and route consequential decisions to qualified review.
  • Do not let generated UI imply a diagnosis, guaranteed return, legal conclusion, or completed transaction without authoritative confirmation.
  • Provide a path to inspect, correct, export, and delete user-supplied data where applicable.

Accessibility and resilience

  • Preserve semantic roles, names, focus order, keyboard operation, and live-region announcements.
  • Never rely on color alone for status or validation.
  • Honor reduced-motion and contrast preferences.
  • Provide text fallback for unsupported components and renderer failure.
  • Test slow streams, partial payloads, reconnects, duplicate delivery, stale actions, and agent timeouts.

Security evidence

The official web core has shipped fixes for URL-opening XSS/tab-nabbing and DataModel prototype pollution. These fixes demonstrate why declarative UI still requires implementation hardening and current dependencies.

This checklist is engineering guidance, not a substitute for a security assessment or legal review.