Zugriffskontrolle für Tools

Tools sind keine Principals

Authorise at the Tool Boundary

def refund_order(order_id, *, user):
    order = db.get_order(order_id)
    if order.customer_id != user.id and not user.is_staff:
        raise PermissionError(f'User {user.id} cannot refund order {order_id}')
    return stripe.refund(order.payment_id)

Benutzerkontext übergeben

def dispatch(tool_call, user):
    args = json.loads(tool_call.function.arguments)
    fn = TOOLS[tool_call.function.name]
    return fn(**args, user=user)

Berechtigungen pro Tool

ROLE_TOOLS = {
    'customer': ['search_orders', 'open_ticket'],
    'support': ['search_orders', 'refund_order', 'cancel_order'],
    'admin': ['*']
}

visible_tools = [t for t in ALL_TOOLS if t.name in ROLE_TOOLS[user.role] or 'admin' in ROLE_TOOLS[user.role]]

Datenzugriff einschränken

def search_orders(query, user):
    # NEVER let the model bypass this WHERE clause
    return db.query('SELECT * FROM orders WHERE customer_id = %s AND ...', (user.id,))

Jeden Tool-Aufruf protokollieren

audit_log({
    'user_id': user.id,
    'tool': tool_name,
    'args': args,
    'result_status': result.status,
    'timestamp': now()
})

Destruktive Aktionen bestätigen

def delete_account(user_id, confirmed=False, user=None):
    if not confirmed:
        return {'requires_confirmation': True, 'msg': 'Confirm deletion of account.'}
    db.execute('DELETE ...', (user_id,))

Tools mit OAuth-/Token-Beschränkung

# Token only has gmail.send scope, not gmail.read
send_email = build_with_token(user_token_scoped_send)

Grenzen für Dienstkonten

Rate Limits Per Tool

def ratelimit(key, per_user_per_day=10):
    counts = {}
    def decorator(func):
        def wrapper(user_id, *args, **kwargs):
            counts.setdefault(user_id, 0)
            if counts[user_id] >= per_user_per_day:
                print(f'{key}: user {user_id} rate limited')
                return None
            counts[user_id] += 1
            return func(user_id, *args, **kwargs)
        return wrapper
    return decorator

@ratelimit(key='tool:refund', per_user_per_day=2)
def refund_order(user_id, order_id):
    print(f'refunding order {order_id} for user {user_id}')
    return True

for i in range(3):
    refund_order('user1', f'order{i}')

Für Benutzer sichtbare Berechtigungsoberfläche

Erneute Authentifizierung für Vorgänge mit hohem Risiko

if tool.is_sensitive and user.last_auth_age_seconds > 300:
    raise StaleAuthError('Please re-authenticate to perform this action.')

Autorisierung wie Code testen

Autorisierungsprinzip

Zusammenfassung