trace_enhance_prd · RC Engine MCP: Risk & Policy

WHAT IT DOES

What trace_enhance_prd does on RC Engine

AI agents use trace_enhance_prd to create or update resources in RC Engine — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your RC Engine environment.

WHY IT NEEDS A POLICY

Why trace_enhance_prd needs a policy

The tool creates new files (enhanced PRD copy, traceability matrix) and generates content (tracking IDs and acceptance criteria). This is a reversible Write operation—it adds metadata and creates new artifacts without modifying source data or triggering external operations. The deterministic ID assignment and acceptance criteria generation are content creation, not destruction or execution of arbitrary code.

From the tool's definition Creates an enhanced copy of PRD with tracking IDs; generates testable acceptance criteria; creates the traceability matrix. Does NOT modify the original PRD - creates an enhanced copy.

Risk signalsBulk/mass operation — affects multiple targets

Attacks that exploit this kind of access

Questions about trace_enhance_prd

What does the trace_enhance_prd tool do? +

Assign tracking IDs to every requirement in the PRD. Call after PRD is created (rc_define or prc_synthesize) and BEFORE building. Auto-discovers PRDs in both pre-rc-research/ and rc-method/prds/. Assigns deterministic IDs by category: PRD-FUNC-001, PRD-SEC-001, PRD-PERF-001, etc. (8 categories). In autonomous mode, also generates testable acceptance criteria. Creates the traceability matrix in rc-traceability/. After success: tell user how many requirements were tagged by category. Does NOT modify the original PRD - creates an enhanced copy. It is categorised as a Write tool in the RC Engine MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on trace_enhance_prd? +

Register the RC Engine MCP server in PolicyLayer and add a rule for trace_enhance_prd: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches RC Engine. Nothing to install.

What risk level is trace_enhance_prd? +

trace_enhance_prd is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit trace_enhance_prd? +

Yes. Add a rate_limit block to the trace_enhance_prd rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block trace_enhance_prd completely? +

Set action: deny in the PolicyLayer policy for trace_enhance_prd. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides trace_enhance_prd? +

trace_enhance_prd is provided by the RC Engine MCP server (originalrashmi/rc-engine-product-framework). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.