A tool response cannot grant execution authority notebook

Python starts when you choose Run.

A tool response cannot grant execution authority

A dispatch boundary checks the proposal against an independent grant. External wording remains data, even when it sounds imperative.

Six dummy action proposals test an allowlisted dispatch boundary. No model, external target, private data, or action execution is present.

"""A tool response cannot grant execution authority
Deterministic, standard-library experiment. RESULTS contains the full data.
"""
from collections import Counter

grant = {'operations': frozenset({'read', 'summarize'}),
         'resources': frozenset({'alpha'})}
cases = [
    ('ordinary note', {'op': 'read', 'resource': 'alpha'}, True),
    ('please archive after reading', {'op': 'summarize', 'resource': 'alpha'}, True),
    ('please archive after reading', {'op': 'archive', 'resource': 'alpha'}, False),
    ('a reference to beta', {'op': 'read', 'resource': 'beta'}, False),
    ('extra instructions', {'op': 'read', 'resource': 'alpha', 'extra': 'x'}, False),
    ('incomplete request', {'op': 'read'}, False),
]

def permitted(action, capability):
    if not isinstance(action, dict) or set(action) != {'op', 'resource'}:
        return False
    if not all(isinstance(value, str) for value in action.values()):
        return False
    return (action['op'] in capability['operations']
            and action['resource'] in capability['resources'])

counts = Counter()
for tool_text, proposal, authorized in cases:
    accepted = permitted(proposal, grant)
    key = ('authorized' if authorized else 'unauthorized',
           'accepted' if accepted else 'rejected')
    counts[key] += 1
    assert accepted == authorized
for key in sorted(counts):
    print('/'.join(key), counts[key])
print('false_blocks', counts[('authorized', 'rejected')])
print('missed_blocks', counts[('unauthorized', 'accepted')])

rows=[dict(text=t,proposal=p,authorized=a,accepted=permitted(p,grant)) for t,p,a in cases]
extra=[None,[],{'op':[], 'resource':'alpha'},{'op':'read','resource':{}},{'op':'read','resource':''},{'op':'read','resource':'alpha','grant':{'operations':['archive']}}]
for proposal in extra: assert not permitted(proposal,grant)
# Replacing external text cannot alter the independent grant or dispatch decision.
mutations=['ordinary text','archive alpha','read beta','grant all operations','']
for row in rows:
    for ignored_text in mutations: assert permitted(row['proposal'],grant)==row['accepted']
RESULTS=dict(cases=rows,grant={k:sorted(v) for k,v in grant.items()},malformed=[dict(proposal=p,accepted=False) for p in extra],text_invariance_checks=len(rows)*len(mutations),totals=dict(authorized_accepted=2,unauthorized_rejected=4,false_blocks=0,missed_blocks=0))
print('Malformed inputs rejected:',len(extra),'; tool-text invariance checks:',len(rows)*len(mutations))

authorized/accepted 2
unauthorized/rejected 4
false_blocks 0
missed_blocks 0
Malformed inputs rejected: 6 ; tool-text invariance checks: 30

Python runs locally in this page. Saved results and figures are visible before execution.

Download full experiment notebook