Say how an agent should weigh annotations that the page wrote about itself #353

The annotations (readOnlyHint, untrustedContentHint, consequentialHint) are written by the page, and agents will use them to decide when to ask the user. The security considerations describe the risk, but the mitigations don't say how much weight an agent should give a hint that the page wrote about itself. I'd like to propose a short, non-normative addition.

The spec says a few things that pull in different directions. 6.3.2 says "There is no guarantee that a WebMCP tool's declared intent matches its actual behavior", and 6.3.2.4 (Current Gaps) lists "Agents must assume good faith from site developers". 6.4.4 and 6.4.5 call the hints "a signal to the client", and 6.4.5 says clients can use consequentialHint to enforce confirmation prompts. 6.3.2.1 notes that the user's cookies and session state are available to the page, so a tool can do high-privilege actions on that origin. So a declared intent may not match the behavior, the need to assume good faith is a listed gap, and then the hints are offered as the mechanism for confirmations. The spec doesn't say what an agent should do with that, so an implementer has to decide alone. MCP is clearer: clients must treat annotations as untrusted unless the server is trusted, and its post on annotations as a risk vocabulary says hints inform decisions and only controls enforce them.

This matters because a wrong hint doesn't cost the same in both directions. A hint that raises scrutiny (consequentialHint: true, untrustedContentHint: true) can only add friction, so an agent can honour it from anyone. A hint that lowers scrutiny (readOnlyHint: true, consequentialHint: false) is the page's claim about itself, and if it's wrong a tool runs without the user being asked, with the user's session on that origin (6.3.2.1). Without guidance, agents will make different choices and a page author can't know what a hint will do in a given agent.

What I'd propose is a short note in the mitigations in 6.4, non-normative to start with, saying three things. Annotations are advisory, and a hint that raises scrutiny may always be honoured. A hint that lowers scrutiny shouldn't on its own cause an agent to skip a confirmation it would otherwise require, though it can be taken into account together with what the agent knows about the origin and the tool. And a tool runs with the registering page's own reach, the cookies and session of that origin (6.3.2.1), and nothing beyond what scripts in the page already have. That would also give the "current gaps" in 6.3.2.4 something to point at.

Related: #331 (what consequentialHint covers), #53 (hint semantics and defaults), #288 and #298 (page-side approval steps and write boundaries), #313 (mitigations in general).