AI tools inside the task boundary

Keep an authorized invoice read working while rejecting a different tenant, object, tool, or model-supplied approval.

AI Security · about 60 minutes. Fictional evidence; Python 3.10+ for local coding.

Prerequisites

Evidence

trusted-context.json

{
  "actor": {
    "id": "alice",
    "tenant": "acme",
    "authenticated": true,
    "scopes": [
      "invoice:read"
    ]
  },
  "task": {
    "actor_id": "alice",
    "tenant": "acme",
    "tool": "invoice.read",
    "invoice_id": "42"
  }
}

proposed-calls.json

[
  {
    "tool": "invoice.read",
    "tenant": "acme",
    "invoice_id": "42"
  },
  {
    "tool": "invoice.read",
    "tenant": "birch",
    "invoice_id": "42"
  },
  {
    "tool": "invoice.send",
    "tenant": "acme",
    "invoice_id": "42",
    "approved": true
  }
]

gateway-contract.txt

The actor and task are resolved by trusted server code. Calls are untrusted model output.
Only invoice.read with invoice:read scope is allowed, for the exact task actor, tenant and invoice ID.
Reject unknown arguments, other tools, another invoice, another tenant, and inactive authentication.
A call field named approved cannot grant permission. Tokens are already validated upstream.

Tasks and expected evidence

  1. Identify the trusted actor and task, then explain why a retrieved instruction cannot expand their authority.
  2. Repair agent_tool_allowed in the Python download; keep the exact allowed read working.
  3. Run --lab agent without --reference. Include the allowed call and denied tenant, object, tool and spoofed-approval cases.
  4. Write a review with evidence references, your command/results, and one real MCP integration test still needed.

Run the coding exercise

Download the Python exercise. It uses only the standard library and no network.

python expert_security_lab.py --lab agent
python expert_security_lab.py --lab agent --reference

Starter mode initially fails. Edit the matching function and rerun without --reference. Reference mode tests supplied code, not your own fix.

Limits

This deterministic policy fixture does not run a model, MCP transport, token validator or approval service. Trusted authentication and task resolution are assumptions to test in a real integration.

All expert cases