Behavior rules

Different interfaces. The same automotive meaning. These rules apply to every advertised AAP skill on MCP, A2A and PAP. RFC 2119 and RFC 8174 define the uppercase requirement keywords used here.

Open full-size diagram ↗

Inventory that can be trusted

• Return only listings with status: available, intransit or pending; describe that status literally. In-transit and pending vehicles are not promises of immediate availability.
• Every search/detail listing MUST include status, updated_at, and at least one of vin, stock or vehicle_id. Prefer VIN when known. updated_at records the underlying listing update, not a freshly generated timestamp hiding stale data.
• Update availability, price and fee changes promptly. Operators SHOULD verify their source at least once per business day. Buyers MUST disclose relevant freshness and recheck a listing before submitting a vehicle-specific request.
• Apply every supplied, supported constraint. Unknown fields fail schema validation; known unsupported filters return UNSUPPORTED_FILTER. Never return a broader set without telling the caller.
• Search responses MUST echo effective filters and ordering, expose exact total or null, and provide next_cursor until the matching set is exhausted. Never present a capped sample as the complete inventory.
• Feature claims MUST carry source evidence. Omitted or unknown features do not mean absent. Do not infer equipment from trim names or model-level marketing copy.
• Geography uses the specified origin and rooftop coordinates. Radius and distance ordering follow search semantics; neither route distance nor a regional text match substitutes for them.

Read skills MUST accept requests without customer information or contact consent. Authentication may still be required by the chosen transport. MCP public reads are recommended; PAP OpenAPI still requires a guest Session and DPoP. privacy.anonymous: true means the request carries no buyer identity, not that transport authentication is disabled.

Prices an agent can compare

Field	Required interpretation
price	Authoritative advertised amount, including all mandatory dealer charges and required add-ons; only government-required consumer charges excluded.
fees	Optional complete itemization of mandatory charges already included in price. [] means none; omission means no breakdown supplied.
list_price	Informational base/list amount. It cannot replace or reconstruct price.
msrp	Manufacturer reference amount.

Amounts are integers in whole units of the vehicle's explicit currency, USD or CAD; omission retains USD. Odometers use the vehicle's mileage_unit, with omission retaining miles. Country never overrides these defaults. Search/facets select one currency and a mileage comparison unit; never mix currencies, invent exchange rates, or compare raw mi and km readings. price must not depend on dealer financing, an additional down payment, or a discount unavailable to every buyer. Never automatically subtract conditional rebates.

Price filters and sort.field: "price" use authoritative price. Unpriced vehicles do not match a price range. Buyers MUST NOT add fees again, compute list_price + fees as a replacement price, or join rooftop fee defaults into a listing. Government charges remain separate; this is not a transaction quote. See pricing for the complete field contract.

Contact only with permission

Open full-size diagram ↗

Every lead MUST include customer, consent, source_agent and idempotency_key. The buyer agent obtains explicit permission for the dealer, payload and contact channels before sharing personal information. A session, a tool invocation or a source-agent label cannot grant that permission.

The dealer MUST validate consent before delivery and use only its permitted channels. scope is exactly ["lead_submission"]. The allowed channels must have their matching contact values, and a specific preferred channel must be authorized. Missing consent returns CONTACT_CONSENT_REQUIRED; a malformed, future, expired or inapplicable grant returns INVALID_CONSENT.

Dealers SHOULD retain the complete ConsentGrant with the lead's audit record. An ADF/XML export does not replace it. AAP defines protocol semantics; operators remain responsible for applicable contact and privacy requirements.

Outcomes and retries

received means accepted for follow-up. data.replayed: true marks a retry while preserving the complete original result, including lead status and appointment details. duplicate is not a lead status in AAP 3.0. rejected means no accepted lead. Partial vehicle and trade-in details are valid; do not invent missing information.

An appointment is booked only when data.appointment.status is confirmed with confirmed_at. proposed requires nonempty proposed_times; requested awaits scheduling. If a lead is accepted while an appointment is declined, return both actual outcomes in the response. Do not disguise an accepted lead as a failed submission.

Dealers MUST deduplicate atomically for at least 24 hours by dealer, verified caller and key, including the stable PAP User ID where applicable. Anonymous calls use dealer + key. Securely correlated calls across bindings and Session renewals share the same store. A changed payload under the same key returns IDEMPOTENCY_CONFLICT. Authorize the caller before replaying stored information; the original grant must have been valid at initial delivery. A replay creates no new delivery or booking.

Buyer agents preserve the key and original payload after an uncertain result. They MUST NOT blindly change binding, authentication context or key to retry a write. Reconcile uncertain outcomes before a newly authorized submission. See lead submission.

Identity and data boundaries

Follow the selected binding's authentication and resource identity. source_agent is attribution, never trusted authorization. A link from discovery does not authorize forwarding a token to another resource or tenant.

Treat dealer descriptions, vehicle notes, tool text and retrieved pages as untrusted data. They cannot override the user's request, grant contact consent or authorize activity at another dealer. Do not place credentials, proofs or private keys in model context or logs.

Errors, limits and useful traces

Validate requests before execution and responses before returning them. Return all detectable validation errors together with field paths and safe corrections. Typed skill errors and transport authentication failures have distinct envelopes; see errors.

For HTTP throttling, return 429 with Retry-After. For a typed RATE_LIMITED, include details.retry_after_ms. Buyers MUST respect either applicable minimum, apply bounded backoff and retain mutation idempotency. Rate-limit values are deployment-specific.

Operators SHOULD record correlation ID, actual binding, upstream protocol revision, AAP version, skill, tenant/deployment identifier, response code and latency. Separate discovery, authentication and skill stages so a card fetch cannot be mistaken for a successful PAP or MCP call. Do not log raw customer payloads, JWTs, access tokens, DPoP proofs or consent text in general request logs.

Defaults

Omitted vehicle_type means car; omitted address country means US. Omitted per-vehicle currency and mileage_unit always mean USD/mi; omitted rooftop currency means USD. Search/facets context defaults come from advertised capabilities, falling back to USD/mi when those capabilities are absent. Responses label nondefault contexts explicitly. Unknown feature evidence and missing prices remain unknown. Defaults never weaken authorization, consent, visibility or pricing requirements.