AI Engineering Academy · 课时

保护智能体的工具访问

将最小权限原则应用于智能体工具权限，在执行破坏性操作前实现确认步骤，并审计智能体操作日志以检测异常行为。

保护智能体的工具访问 是 CoddyKit 上的免费 AI Engineering Academy 课时。这是第 3 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 AI Engineering Academy 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 AI Engineering Academy 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

The Tool Access Security Problem

When you give an AI agent a tool, you give it the ability to take real-world actions. A tool that sends emails, runs SQL queries, calls payment APIs, or modifies files can cause significant harm if the agent is compromised by a prompt injection or simply makes a mistake. Securing agentic tool access means designing your tool layer so the damage from any individual tool use is bounded, auditable, and reversible where possible.

The Principle of Least Privilege

Apply the principle of least privilege to every tool: give the agent the minimum access necessary to complete its assigned task, and nothing more. If the agent needs to read customer records, give it a read-only database connection — not the full admin connection you use for maintenance. If it sends notifications, scope its API key to the notification endpoint only. Least privilege limits the blast radius of any security incident.

from enum import Enum
from dataclasses import dataclass

class Permission(Enum):
    READ_CUSTOMER_PROFILE = 'read_customer_profile'
    SEND_NOTIFICATION = 'send_notification'
    READ_ORDER_HISTORY = 'read_order_history'
    WRITE_CUSTOMER_PROFILE = 'write_customer_profile'  # higher privilege
    PROCESS_REFUND = 'process_refund'                  # highest risk

@dataclass
class AgentIdentity:
    agent_id: str
    allowed_permissions: set[Permission]

# Support chat agent: read-only + send notification only
SUPPORT_AGENT = AgentIdentity(
    agent_id='support-agent-v1',
    allowed_permissions={
        Permission.READ_CUSTOMER_PROFILE,
        Permission.READ_ORDER_HISTORY,
        Permission.SEND_NOTIFICATION  # can notify, but NOT write or refund
    }
)

# NOT: give every agent all permissions for convenience

Permission-Gated Tool Execution

Enforce least privilege at the execution layer, not just at the design layer. Every tool call must pass through a permission check that verifies the calling agent has the required permission for that specific action. This cannot be bypassed by the agent or a prompt injection because it is enforced in code, not in the LLM's prompt.

class ToolGateway:
    def __init__(self, agent: AgentIdentity):
        self.agent = agent
        self.audit_log = []

    def execute_tool(self, tool_name: str, required_permission: Permission, tool_fn, **kwargs) -> dict:
        # Permission check - enforced in code, not in the LLM prompt
        if required_permission not in self.agent.allowed_permissions:
            self.log_denied(tool_name, required_permission, kwargs)
            raise PermissionError(
                f'Agent {self.agent.agent_id} does not have permission: {required_permission.value}'
            )
        
        # Execute tool
        result = tool_fn(**kwargs)
        self.log_allowed(tool_name, kwargs, result)
        return result

    def log_denied(self, tool: str, permission: Permission, args: dict):
        entry = {'type': 'DENIED', 'agent': self.agent.agent_id, 'tool': tool, 'permission': permission.value, 'args': args}
        self.audit_log.append(entry)
        print(f'SECURITY: Permission denied - {entry}')

    def log_allowed(self, tool: str, args: dict, result):
        entry = {'type': 'ALLOWED', 'agent': self.agent.agent_id, 'tool': tool, 'args': args}
        self.audit_log.append(entry)

gateway = ToolGateway(SUPPORT_AGENT)

# This will succeed (agent has READ permission)
gateway.execute_tool('read_profile', Permission.READ_CUSTOMER_PROFILE, read_customer_profile, user_id='123')

# This will raise PermissionError (agent lacks PROCESS_REFUND permission)
gateway.execute_tool('process_refund', Permission.PROCESS_REFUND, process_refund, order_id='456', amount=50.00)

Confirmation Steps for Destructive Actions

Some actions are irreversible or high-impact: deleting records, sending bulk emails, processing financial transactions. Require explicit human confirmation before the agent executes any such action. The agent proposes the action (what it wants to do and why), a human approves or rejects it, and only then does execution proceed. This confirmation gate is the single most effective defense against agent errors and injection-driven abuse.

HIGH_RISK_ACTIONS = {
    'delete_customer_record',
    'send_bulk_email',
    'process_refund_over_100',
    'deploy_code',
    'revoke_user_access'
}

def execute_with_confirmation(tool_name: str, tool_args: dict, agent_reasoning: str) -> dict:
    if tool_name in HIGH_RISK_ACTIONS:
        # Pause and request human approval
        approval_request = {
            'action': tool_name,
            'arguments': tool_args,
            'agent_reasoning': agent_reasoning,
            'risk_level': 'HIGH'
        }
        approval = request_human_approval(approval_request)  # blocks until human responds
        
        if not approval.approved:
            return {'status': 'rejected', 'reason': approval.rejection_reason}
        
        # Log the approval for audit trail
        log_approval(tool_name, tool_args, approved_by=approval.approver_id)
    
    # Execute only after confirmation
    return execute_tool(tool_name, **tool_args)

Tool Scoping: Time, User, and Data Boundaries

Beyond permission types, scope tool access along three dimensions. Time boundaries: API keys or tokens that expire after the agent's session ends. User boundaries: an agent helping user A should never access user B's data, even if the agent is instructed to. Data boundaries: a customer support agent should access only the data of the customer it is currently helping, not all customers. Implement these boundaries in your tool implementations, not in agent prompts.

class ScopedCustomerTool:
    def __init__(self, current_user_id: str, session_token: str):
        self.user_id = current_user_id  # agent can only access THIS user's data
        self.token = session_token       # expires at end of session

    def get_customer_profile(self) -> dict:
        # Hardcoded to current user - agent cannot change this via prompt
        return db.query(
            'SELECT * FROM customers WHERE id = %s',
            (self.user_id,)  # parameterized, always this user's ID only
        )

    def get_order_history(self, limit: int = 10) -> list:
        # Even if the agent says 'get orders for user 999', it gets self.user_id
        return db.query(
            'SELECT * FROM orders WHERE customer_id = %s ORDER BY date DESC LIMIT %s',
            (self.user_id, min(limit, 50))  # cap limit too
        )

# Inject scoped tool into agent - cannot be overridden by prompt
def create_support_agent(user_id: str, session_token: str):
    scoped_tools = ScopedCustomerTool(user_id, session_token)
    return AgentExecutor(llm=llm, tools=[scoped_tools.get_customer_profile, scoped_tools.get_order_history])

Input Validation on Tool Arguments

Agents generate tool arguments as text. Before executing any tool, validate all arguments against a strict schema. This prevents: SQL injection through tool parameters, path traversal attacks (agent passing '../../../etc/passwd' as a file path), SSRF attacks (agent passing an internal service URL as a 'remote URL' parameter), and integer overflow or out-of-range values that could cause unexpected behavior.

from pydantic import BaseModel, validator, constr, confloat
import re

class SendEmailArgs(BaseModel):
    to: str
    subject: constr(max_length=200)
    body: constr(max_length=10000)

    @validator('to')
    def must_be_company_email(cls, v):
        if not re.match(r'^[^@]+@(?:yourcorp\.com|partner\.com)$', v):
            raise ValueError('Email must be sent to yourcorp.com or partner.com domains only')
        return v

class ReadFileArgs(BaseModel):
    filename: constr(pattern=r'^[a-zA-Z0-9_\-\.]+$')  # alphanumeric only, no path traversal

    @validator('filename')
    def no_parent_directory(cls, v):
        if '..' in v or '/' in v or '\\' in v:
            raise ValueError('Path traversal detected')
        return v

# Validate before execution
def validated_send_email(args_dict: dict) -> dict:
    args = SendEmailArgs(**args_dict)  # raises ValueError on invalid input
    return send_email(args.to, args.subject, args.body)

Immutable Audit Logging

Every tool call made by an agent must be logged in an immutable audit log. The log entry must include: the agent ID and session ID, the tool name and all arguments, the return value, the timestamp, and the agent's stated reasoning for making the call. Immutable means the agent (or an attacker) cannot delete or modify log entries. Use append-only storage (cloud logging services, write-once databases, or WORM storage).

import hashlib
import json
import time

class ImmutableAuditLog:
    def __init__(self, log_backend):
        self.backend = log_backend  # e.g., CloudWatch, BigQuery, or append-only file
        self.previous_hash = '0' * 64  # genesis hash

    def record(self, agent_id: str, tool_name: str, args: dict, result, reasoning: str):
        entry = {
            'agent_id': agent_id,
            'tool': tool_name,
            'args': args,
            'result_summary': str(result)[:500],  # truncate large results
            'reasoning': reasoning[:1000],
            'timestamp': time.time(),
            'previous_hash': self.previous_hash  # chain entries like a blockchain
        }
        
        entry_json = json.dumps(entry, sort_keys=True)
        entry['hash'] = hashlib.sha256(entry_json.encode()).hexdigest()
        
        self.backend.append(entry)  # append-only, never update
        self.previous_hash = entry['hash']
        
        return entry['hash']

Detecting Anomalous Agent Behavior

Even with permission gates and audit logs, watch for anomalous behavior patterns that suggest an agent has been compromised or is behaving unexpectedly. Anomaly signals include: a support agent suddenly calling tools it has never called before, an unusual spike in tool call frequency from one agent, arguments that differ from the norm in suspicious ways (unusually long strings, strange character sequences), or calls that happen at unusual hours.

from collections import Counter

class AgentBehaviorMonitor:
    def __init__(self):
        self.tool_call_counts = Counter()  # tracks historical tool usage
        self.arg_length_history = {}       # tracks typical argument lengths

    def record_and_check(self, agent_id: str, tool_name: str, args: dict) -> list[str]:
        key = f'{agent_id}:{tool_name}'
        anomalies = []
        
        self.tool_call_counts[key] += 1
        
        # Flag tools never called before by this agent
        if self.tool_call_counts[key] == 1 and tool_name not in COMMON_TOOLS:
            anomalies.append(f'First time agent {agent_id} called unusual tool: {tool_name}')
        
        # Flag unusually long arguments (potential injection payload)
        total_arg_length = sum(len(str(v)) for v in args.values())
        if tool_name not in self.arg_length_history:
            self.arg_length_history[tool_name] = []
        self.arg_length_history[tool_name].append(total_arg_length)
        
        if len(self.arg_length_history[tool_name]) > 10:
            avg = sum(self.arg_length_history[tool_name]) / len(self.arg_length_history[tool_name])
            if total_arg_length > avg * 5:
                anomalies.append(f'Unusually long arguments for {tool_name}: {total_arg_length} chars (avg: {avg:.0f})')
        
        return anomalies

Token Expiry and Session Scoping

Agent sessions should have a defined lifespan. Issue short-lived tokens or credentials to the agent when a session starts, and revoke them when the session ends. If an agent's session is compromised mid-execution, an attacker's ability to exploit the compromised session is bounded by the token's expiry. Session scoping also ensures that a single compromised agent cannot be used for follow-up attacks days later.

import secrets
import time

class SessionTokenManager:
    def __init__(self, ttl_seconds=3600):
        self.tokens = {}  # token -> (agent_id, user_id, expires_at)
        self.ttl = ttl_seconds

    def issue_token(self, agent_id: str, user_id: str) -> str:
        token = secrets.token_urlsafe(32)
        expires_at = time.time() + self.ttl
        self.tokens[token] = (agent_id, user_id, expires_at)
        return token

    def validate_token(self, token: str) -> dict | None:
        if token not in self.tokens:
            return None
        agent_id, user_id, expires_at = self.tokens[token]
        if time.time() > expires_at:
            del self.tokens[token]  # clean up expired token
            return None
        return {'agent_id': agent_id, 'user_id': user_id}

    def revoke_token(self, token: str):
        self.tokens.pop(token, None)

token_manager = SessionTokenManager(ttl_seconds=1800)  # 30-minute sessions

Testing Tool Security

Test your tool security layer by simulating attacks: try calling a restricted tool with an unauthorized agent, provide path traversal arguments, inject instruction strings into tool parameters, and attempt to call tools with expired tokens. A comprehensive tool security test suite should cover all permission boundaries, all validation rules, and all anomaly detection triggers.

Designing for Reversibility

Where possible, design tools to be reversible or staged. Instead of immediately deleting a record, mark it as deleted with a tombstone so it can be restored. Instead of sending an email immediately, put it in a 'pending send' queue that executes after a 5-minute review window. Stage financial transactions with a hold before settlement. Reversibility does not eliminate the security risk but dramatically reduces the impact of successful attacks.

Quick Check

Test your understanding of securing agentic tool access from this lesson.

Lesson Recap

In this lesson you learned: the principle of least privilege limits tool permissions to what each agent role actually needs, code-level permission gates enforce these permissions in a way that cannot be bypassed by prompt injection, and human confirmation steps for high-risk actions provide a final safety net before irreversible operations execute. Next up we run a structured red-team exercise on LLM applications.

常见问题解答

「保护智能体的工具访问」课时是免费的吗？

是的 — 「保护智能体的工具访问」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 AI Engineering Academy 课程的其余内容，请升级到 CoddyKit PRO。 AI Engineering Academy 课程共包含 4 节课。

「保护智能体的工具访问」这节课中我会学到什么？

将最小权限原则应用于智能体工具权限，在执行破坏性操作前实现确认步骤，并审计智能体操作日志以检测异常行为。你通过在浏览器中直接运行的动手代码来练习 AI Engineering Academy，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 AI Engineering Academy 需要有经验吗？

无需任何先前经验。CoddyKit 上的 AI Engineering Academy 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 3 节课，共 4 节。

「保护智能体的工具访问」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 AI Engineering Academy 课中编写并运行代码吗？

能。每节 AI Engineering Academy 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 AI Engineering Academy