Compliance & Guardrails Baseline

Purpose

LeadVault Exec exposes a defined set of read-only tools via the Model Context Protocol (MCP), allowing approved AI clients (e.g., Claude, ChatGPT) to query platform data. This document outlines the baseline compliance guardrails governing tool access for any client vertical ahead of publishing, and is applied per-client as new verticals or partners come online.

Guardrails (Baseline, All Verticals)

• Regulated-industry outputs (FINRA / SEC / state insurance, etc.) — Tool outputs are data-only (name, price, feature summary). No performance projections, quotes, or advisory framing ("recommended for you") are permitted in any response.
• Audit trail — Every MCP query/response involving client or regulated data is logged (caller, timestamp, payload).
• TCPA / contact privacy — Any tool returning contact info (agent, realtor, client) is strictly read-only. No bulk export or list-harvesting capability is enabled.
• No auto-outreach — No tool may auto-trigger outbound communication (call, text, email). All outreach remains a human-approved workflow outside of MCP.
• Vertical / client separation — Tools are tagged and scoped per vertical and per client account to prevent cross-vertical or cross-tenant data exposure.
• Renewal / review cadence — Any tool exposing renewal, review, or follow-up dates may only surface data internally; it cannot initiate client-facing contact.
• New-client onboarding — Each new client/vertical is checked against this baseline before its tools are published; industry-specific rules are added as an addendum, not a replacement.

Current Tool Status

Pre-Publish Requirements

• Confirm list_pricing_plans output contains zero advisory language.
• Confirm get_realtor_site has no unconsented contact-harvesting or bulk export path.
• Apply vertical tags to separate insurance and real-estate tool scopes.
• Enable query/response logging prior to publish.
• Validate via live MCP client test in staging before production publish.
• Update the Current Tool Status table on the /compliance page to reflect new publish status.