A²D Mock Integration

A protocol-aware Mulesoft Flex / Omni Gateway custom policy that operationalizes A²D’s Design → Test → Runtime loop at the edge.

The mock is already the source of truth for behavior. This policy makes it the source of truth at the edge: zero client-side config churn to flip an environment, automatic contract validation everywhere, and shadow-diff visibility for the moments when reality diverges from the spec.

Four orthogonal modes

The policy supports four modes that combine in any subset. The default is ["validate"].

redirect

Rewrites the upstream URL for this asset to the A²D mock:

• REST → {baseUrl}/api/platform/{assetId}/api/...
• MCP → {baseUrl}/api/platform/{assetId}/mcp
• A2A → {baseUrl}/api/platform/{assetId}/a2a

Authenticates with the credentials in mockAuthSecretRef. Refused in env=prod unless prodAllowed=true plus a Govern approval token.

validate

Protocol-aware request/response validation against the A²D-canonical spec.

• REST — path + method match against the OpenAPI document, status range check.
• MCP — JSON-RPC parse, method whitelist, tools/call.name matched against the spec’s tool list.
• A2A — A2A envelope parse, skill matched against the agent card’s declared skills.

Validation failures produce evidence events. By default validation is observational; pair with the Govern policy for a hard gate.

shadow

Asynchronously mirrors a sampled fraction of requests to the A²D mock and diffs the responses. The primary request is never affected; the diff result is an evidence event only.

Sampling is deterministic per request (FNV-1a hash of method + path) so a repeated request lands on the same yes/no decision — useful for diff stability across mock runs.

fault

Probabilistically rewrites the request to invoke a specific A²D scenario (fault.scenarioId) so the mock returns errors, delays, or malformed responses. Gated to non-prod by default; the prod-allowed path requires Govern approval.

Configuration

Recommended mode mixes

Evidence

Every decision produces a JSON line through the PDK logger and (when A²D reporting is wired) POSTed to {baseUrl}/api/policy/evidence as a run-style record compatible with a2tf_run_results. A²D Test Lab surfaces these as “Runtime Runs” alongside scheduled test runs.

{
  "class": "spec_validation_failure",
  "severity": "warning",
  "decision": "allowed",
  "asset_id": "demo-asset",
  "asset_type": "mcp",
  "env": "pre_prod",
  "modes": ["redirect", "validate"],
  "scenario_id": "scn-42",
  "diff_summary": "tool 'delete_account' not declared in spec",
  "note": null
}

class ∈ spec_validation_failure | shadow_divergence | fault_injected | mock_unavailable | spec_unavailable | scenario_applied | prod_guard_blocked.

Why this is the most differentiated policy

A²D is uniquely positioned to ship this because A²D owns:

• the spec (canonical contract for REST/MCP/A2A),
• the mock (executor that already speaks those protocols),
• the scenario library (chaos-test fixtures, mock-data presets, fault recipes).

No other gateway vendor can credibly offer “validate + redirect + shadow + fault, all driven by one asset spec.” The drift-detection policies are a smaller cut of the same surface — Mock Integration is the full Design → Test → Runtime contract enforced at the edge.

Reference deployment

The upstream A²D mock declares an order-management MCP server with three tools (get_order, list_orders, update_order_status) — the methods covered by the canonical spec the policy validates against.

Try it

tools/list — validation passes:

curl -sS -X POST \
  https://agent-network-ingress-gw-zovwbn.jeg62f.usa-e2.cloudhub.io/mcp-mock-integration-demo \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'

tools/call for a declared tool:

curl -sS -X POST \
  https://agent-network-ingress-gw-zovwbn.jeg62f.usa-e2.cloudhub.io/mcp-mock-integration-demo \
  -H 'Content-Type: application/json' \
  -d '{
    "jsonrpc":"2.0","id":2,
    "method":"tools/call",
    "params":{"name":"get_order","arguments":{"orderId":"ord_001"}}
  }'

tools/call for an undeclared tool — emits a spec_validation_failure evidence event (observational; request still flows because the policy is in validate mode without an enforcing Govern follow-up):

curl -sS -X POST \
  https://agent-network-ingress-gw-zovwbn.jeg62f.usa-e2.cloudhub.io/mcp-mock-integration-demo \
  -H 'Content-Type: application/json' \
  -d '{
    "jsonrpc":"2.0","id":3,
    "method":"tools/call",
    "params":{"name":"delete_account","arguments":{}}
  }'

The evidence row appears in A²D Test Lab under “Runtime Runs” alongside scheduled-test results.

Pair with

• Drift Detection (A²D) — share the same A²D-canonical spec for descriptor pinning.
• Poisoning Detection (A²D) — add shadowing + prompt-injection heuristics on top of validation.
• Test Lab — view runtime evidence next to scheduled-test results.

Next Steps

• Drift detection via A²D →
• Test Lab →
• MCP server design →

Mock Integration is the full Design → Test → Runtime loop, enforced at the edge.