Tool authorization.

TECHNICAL NOTE / 30 OCTOBER 2026 / SYNTHETIC TEACHING EXAMPLE

The small distinction with real consequences

Suppose a connected AI tool is allowed to retrieve one account record. The request might also ask to edit that account or read a different person's records. Should the application accept those actions because the agent requested them?

In our small example, an application-layer function checks the action and account scope against a configured policy before allowing an operation. The request text itself cannot grant the additional permission.

Here is the boundary

The policy check below is the core of the original demonstration. It is intentionally small enough to read and test:

def authorize(principal, request):
    if request.account not in principal.allowed_accounts:
        return Decision(False, "account outside the delegated scope")
    if request.action not in principal.allowed_actions:
        return Decision(False, "action not delegated to this agent")
    return Decision(True, "request within the delegated scope")

In the real world, the principal and its permissions must come from a trusted authenticated system. The demonstration does not implement that part.

What it shows

Different operations and resources need different permissions. Authorization must be enforced by the application or protected system, not supplied by generated prose. An action the code hasn't implemented stays unavailable.

What it doesn't show

The example uses caller-supplied principal objects. It does not authenticate a person or agent, run a real model, secure a database, test malicious prompts against a production service or demonstrate resistance to all privilege escalation. A deployed system needs trusted identity, appropriate policy enforcement, audit, review and threat modeling.

The repository includes Python source, a README and seven unit tests. Those tests exercise this limited program, not an operational AI agent or an external client's system.

Read source and test files

For production design guidance, see the OWASP AI Agent Security Cheat Sheet on least privilege, authorized tool access, approval and independent policy enforcement.