jperezduerto.info
Security in depth · Unit 27 · Lesson 7 of 11
Tools need independent permission checks
Evaluate a proposed tool action against the caller’s actual resource permissions.
Helpful before thisAI on offense
After this lesson you can
- Identify the caller, action, and resource an independent tool boundary must authorize.
One idea. One situation. One reasoned decision.
How it works
A model can propose an operation, but a separate control should evaluate the actual caller, action, resource, and arguments. Give tools narrow authority and avoid treating the model’s explanation as proof of authorization. A confirmation flow should show the concrete effect when human approval is needed. Controls at the tool boundary remain necessary even when prompts ask the model to behave carefully.
A capable tool can exceed the caller’s role
A fictional case assistant can propose status changes. The server, rather than the model, owns the authorization decision.
| Record | Supplied fact |
|---|---|
| P1 | Caller Nia may update case A; may only read case B |
| P2 | Model proposes closing case B |
| P3 | Tool’s service identity technically supports updates to both cases |
Worked decision: deny this update to B under Nia’s authority. P3 describes the tool’s technical capability, not a permission grant to the caller. The boundary must evaluate the actual caller, requested action, and specific resource before any change.
An allowed alternative could be a read-only summary of B, within the permitted fields and task. Updating A would still need a valid request and the relevant business rules; permission to update is not approval of every possible status transition.
Keep the model’s explanation separate from the enforcement result. A persuasive statement that closing B is helpful cannot replace the resource check. Record the denial in a way that supports review without copying sensitive case contents. If authorization changes later, evaluate the concrete new request under the current rules rather than reusing the old model proposal as standing permission.
The key distinction: Language generation and access enforcement are different functions.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which boundary decision correctly handles P1-P3?
Show the answer
Correct answer: Deny the proposed update to B because Nia has only read permission there. The caller lacks the requested action on that resource. The service identity’s broader capability does not supply the missing caller authorization.
Try it
- WriteWrite an authorization decision for P1-P3 and a permitted alternative. Name the principal whose authority should constrain the action, even if the tool uses a broader service identity.