# a2zz AI Catalog Bridge for WooCommerce Security Model

## Public shopping-agent boundary

The public WebMCP interface is deliberately read-only. It exposes only three catalog functions:

- `search_products`
- `get_product_details`
- `check_stock`

Public tools are limited to whitelisted data from published WooCommerce products. They do not expose customer records, orders, credentials, WordPress configuration, private/draft products, arbitrary post meta, or exact stock quantities.

The plugin contains no public capability for editing products, changing prices or inventory, issuing refunds, modifying users, installing plugins, uploading files, executing PHP/SQL, or changing WordPress settings.

## Merchant AI-assistant boundary

AI administration is Off by default and is separate from public storefront tools.

- **Off**: no A2ZZ administration abilities are registered.
- **Assisted**: an authenticated, authorized merchant AI may inspect A2ZZ status/settings, request explanations, and run diagnostics.
- **Full A2ZZ Control**: the merchant AI may additionally enable or disable only A2ZZ's three storefront shopping tools.

AI administration requires an authenticated WordPress user with `manage_woocommerce` or `manage_options`. Browser-session administration uses a WordPress REST nonce in addition to capability checks.

An AI assistant cannot change its own A2ZZ access level. Only the human-facing WordPress settings form can change Off / Assisted / Full A2ZZ Control.

## Free-core access boundary

A2ZZ Free does not use product count, time, request volume, or payment status to disable the three included storefront tools.

If WooCommerce is active and a merchant has enabled an included tool, catalog size alone does not block that tool.

Any future paid add-on must add distinct functionality rather than acting as a key that re-enables free-core features.

## Frontend exposure and source protection

A2ZZ assumes browser-delivered JavaScript can be inspected or copied through normal browser developer tools.

Accordingly:

- Frontend JavaScript contains no credentials, private keys, commercial license secrets, or proprietary decision logic.
- Browser code does not determine authorization or any future paid-add-on entitlement; PHP performs those checks server-side.
- The WordPress.org free core contains no product-count or usage-quota paywall for its included features.
- Public endpoint URLs, WebMCP tool names, schemas, descriptions, and browser adapters are treated as non-secret.
- The browser receives only data needed for the current user/agent task.
- No security control is considered valid solely because it is hidden, minified, or omitted from the visible UI.

A self-hosted WordPress customer necessarily receives the plugin's PHP files on their own server. A2ZZ therefore does not claim that source copying can be made impossible. Commercial protection should rely on controlled distribution, separate paid add-ons, authenticated update access, support, compatibility maintenance, branding, and continued product development rather than on frontend obscurity.

## Data minimization

Catalog output is constructed from an explicit allowlist. Descriptions are stripped of HTML/shortcodes and length-limited. Searches and result counts are bounded. Variation summaries are bounded.

## Reporting a security issue

Before public distribution, replace this section with the production security-contact process for A2ZZ.