add security considerations

[ZhengShenghan]

🔗 Related Issue | 相关 Issue

Related to #78.

This PR follows the maintainer request for concrete recommendations for a Security Considerations section:
#78 (comment)

It also keeps the protocol/application boundary discussed in #79: ANP provides identity proof, message integrity, protocol negotiation context, and implementation hooks, while task-specific authorization, prompt-injection handling, and application semantics remain application/runtime responsibilities.

---

📝 PR Type | PR 类型

• Feature | 新功能
• Bugfix | 问题修复
• Documentation | 文档修改
• Style | 代码格式（不影响功能）
• Refactor | 重构
• Test | 测试相关
• Chore | 其他

---

📋 Description | 描述

This PR adds a cross-cutting ANP Security Considerations document and links it from README.md and docs/links.md.

The new document summarizes implementation-facing security guidance across the ANP specifications, including:

• separating DID-based authentication from application/resource authorization
• clarifying credential, key, replay-protection, and access-token lifecycle guidance
• exposing security-relevant event hooks to applications and runtimes
• sandboxing and verifying generated or negotiated protocol handlers
• preserving identity, protocol, and authorization context across cross-protocol bridges

The document is intended to complement the existing DID:WBA, Agent Description, Agent Discovery, Meta-Protocol, and Messaging specifications, not replace their protocol-specific requirements.

---

⚠️ Breaking Changes | 破坏性变更

• Yes
• No

---

✅ Checklist | 检查项

• The code compiles correctly | 代码可以正确编译
• All tests passed | 所有测试均通过
• Relevant documentation updated | 已更新相关文档
• PR has been linked to the related issue | 已关联相关 Issue

[chgaowei]

Thank you very much for your contribution to ANP. We really appreciate your effort in analyzing the security aspects of the protocol and preparing a dedicated Security Considerations document.

This PR addresses an important topic. It is necessary to clearly define the security boundaries between identity, authentication, authorization, application logic, and runtime responsibilities. The clarification that authentication does not automatically imply authorization is especially valuable.

After reviewing this PR, I think the overall direction is good and this document is worth adding to ANP. However, there are several points that need to be adjusted before merging:

1. Please rebase the PR on the latest main branch.

   The current branch is behind the latest changes, and some document structures have changed. Please update the branch first and resolve any conflicts.

2. The filename 10-security-considerations.md needs to be changed.

   ANP-10 is already used by the Agent Payment Protocol, so this name may cause confusion.

   We suggest moving it to something like:
   docs/security-considerations.md

3. Please clarify the status of this document.

We suggest positioning it as a:

• Security guidance
• Implementation guidance

document rather than a new protocol specification.

4. The current document should further clarify two points from Issue Clarify security responsibilities for consent, auditability, credential revocation, and replay protection #78:

• Access token revocation semantics

  • For example, whether revocation should take effect immediately or mainly rely on token expiration.

• Replay protection assumptions

  • Including different deployment scenarios such as multi-instance deployments and service restart situations.

5. The section about generated protocol handlers should be updated according to the latest ANP-06 design.

The current ANP-06 no longer focuses on remote code generation or code exchange. It would be better to focus on:

• Protocol artifact verification;
• Digest/signature verification;
• Treating external artifacts or generated code as untrusted;
• Sandbox and least-privilege execution.

6. Some security statements should distinguish between HTTP-specific behavior and general ANP behavior.

For example:

• 401 Unauthorized and 403 Forbidden error semantics apply to HTTP bindings;
• Other transports should follow their corresponding Profile-specific error model.

7. Since ANP now includes the Agent Payment Protocol (ANP-10), please consider adding a reference that payment-related scenarios require additional security considerations.

These may include:

• Authorization;
• Transaction integrity;
• Replay protection;
• User confirmation.

Thank you again for this valuable contribution. The overall direction of this PR is correct. After these adjustments, I believe this Security Considerations document will become an important part of the ANP documentation set.