Authority is enforced, not documented
Rulings outrank doctrine; doctrine outranks narrative. The precedence chain is executed by the tools that answer questions, so an agent cannot quote a handover over a ruling by accident.
A Model Context Protocol (MCP) server for a 388,000-page platform where the expensive failure was never a bug — it was an agent acting confidently on a stale number, or re-opening a question the owner had already ruled on.
It runs in Python on Cloud Run under Google Cloud Platform (GCP), reads the estate over BigQuery and SQL, and exposes 26 tools to Anthropic Claude through tool calling. The fix was architectural, not procedural. The rules stopped being documentation an agent could skim and became a surface it had to transact against.
The Numbers
Panel 01
Tools Exposed
26
Source — junelife-ops MCP server on Cloud Run; measured 2026-08-08, live production count.
Tools That Write
1
Source — server write-scope: only the pre-fire receipt tool writes, and only to the declared receipts sink.
Pages Governed
388,329
Source — junelifeinsurance.com, live sitemap index, 2026-08-08.
Stored Credentials
0
Source — keyless auth via workload identity federation; 0 plaintext service-account keys, marker-verified.Architecture
Panel 02Design Decisions
Panel 03Tools execute filed protocols
Protocol tools run the checked-in markdown protocol rather than reimplementing it. The file stays the single source; the tool is only the executor. Drift between doc and behaviour becomes structurally impossible.
Refusal is a feature
The pre-fire receipt binds a normalised snapshot of the estate. If anything moved between the snapshot and the go-ahead, verification refuses — the approval no longer describes reality, so it no longer counts.
One writer, by architecture
No tool can file a ruling, edit the ledger, or fire a build. Exactly one writes, to one declared sink. The owner's authority is not a policy an agent is asked to respect — it is a capability the agent does not have.
Bytes, never summaries
Verbatim quotes are checked against stored raw bytes, not headers or prior summaries. Identity flows bytes → summary and never the reverse, which is how a paraphrase stops being able to impersonate a source.
Every figure is a pointer
Returned numbers are explicitly typed as pointers, never facts, and must be re-measured from disk before any irreversible action. Two states — unparsed and absent — are reported and never inferred from prose.
Incident Log
Panel 04Entry 001 · Closed
- Date
- 2026-06
- Symptom
- $11,089.77 billed against $0.71 expected — a greater-than-1000% anomaly. Charges accumulated across roughly 48 hours, 7–8 June, before the account was suspended.
- Diagnosis
- A compromised firebase-adminsdk service-account key. The provider's suspension notice cited activity consistent with hijacked resources.
- Cure
- Moved to a keyless architecture on workload identity federation. Every user-managed key disabled; five plaintext key files shredded, including two that survived in cloud-synced folders and were found only because a previously killed sweep was re-run.
- Permanent
- Zero plaintext service-account keys anywhere under the home tree, marker-verified rather than assumed. A standing rule now blocks any credential-shaped artifact from entering a long-lived archive — scrub the exported copy, never the read-only source.
- Resolution
- Project reinstated 2026-06-17. Charges reversed by two banks independently as fraud. The full $11,089.77 was credited back.
- Press
- The Register, 2026-07-03 — case covered, operator named.
- Response
- Google Cloud (official account) — public reply to the operator's comment on Google Cloud CEO Thomas Kurian's AI-security post.