Tests least-privilege thinking for tool access. Strong answers list allowed actions and deny the rest by default.
Give the agent only the tools the task needs, with the narrowest scope. Anything unlisted is denied, since an open default fails at the worst moment.
ALLOW = {"read_log": True, "run_lint": True}
def decide(action):
# fail closed: anything not listed is denied
return ALLOW.get(action, False)
bad = []
if decide("read_log") is not True:
bad.append("read_log should be allowed")
if decide("run_lint") is not True:
bad.append("run_lint should be allowed")
if decide("push_to_main") is not False:
bad.append("unlisted push should be denied")
if decide("read_secrets") is not False:
bad.append("secrets should be denied")
if bad:
print("FAIL: " + "; ".join(bad))
raise SystemExit(1)
print("PASS: listed reads allowed, push and secrets denied")The gate above is a plain allow-list, not a real permission system. It proves fail-closed behavior, including for the unlisted push it never names as allowed.
Tests approval placement for risky actions. Strong answers approve before the irreversible step, not after.
Require explicit approval for external, irreversible, or wide-blast-radius actions. Show the approver the exact diff or command, never a summary alone.
Agent acts alone | Human approves first | Why |
|---|---|---|
Read logs and search code | Push, merge, or deploy | Reads reverse cleanly; pushes do not. |
Draft a fix | Delete data or rotate keys | Drafts are cheap; deletion is not. |
Summarize results | Send mail or file tickets | Sending speaks for the team. |
Tests expected-loss thinking before acting. Strong answers compare the review cost against the risk removed.
EXAMPLE parameters (not real amounts): a bad push costs 40 units, its chance is 0.05
expected loss = 40 x 0.05 = 2.0 units
human review costs 0.5 units and blocks the push
0.5 < 2.0, so review is cheaper than the risk it removesWhen the output cannot be trusted, say so and show the check. A guarded no beats an unguarded maybe.
Deny. Unlisted actions are denied by default; the human adds the tool only after reviewing the need.
Yes: 0.5 is less than 2.0. The review is cheaper than the risk it removes at these example parameters.