Unit 10.01: Designing the permissions and the gate

Three read-only tools, one that writes reversibly, and exactly one that needs a gate.

The effect column decides everything

Each tool with its effect and whether it is gated, plus the limits and what enforces them.

Below is the design.

TOOL             EFFECT                      GATE
get_invoice      read                        none
get_contract     read                        none
add_note         write, reversible           none
post_credit      moves money, irreversible   APPROVAL REQUIRED

LIMITS           maximum credit 500.00, currencies USD and EUR
GATE POSITION    immediately before post_credit
GATE SHOWS       what will happen, why, the evidence, what happens if you
                 do nothing
ENFORCED BY      the tool list and its written argument rules -- not by
                 instructions to the agent

3 read-only tools, 1 gated. The agent has no way to post a credit without
an approval recorded against it.

One gated tool out of four, and it is the only one with an irreversible effect. The agent physically cannot post a credit without an approval field, because the tool signature requires one.

enforced_by is stated explicitly: tool signatures and argument validation, not instructions. Writing that line forces you to check whether it is true, which is most of its value.

The mistake this prevents

The mistake is designing the tools around what the agent needs to be useful and adding restrictions afterwards. Restrictions added afterwards end up in prompts, because changing a tool signature by then means changing every call site.

Takeaway

Sort tools by effect, gate the irreversible one, and state what enforces the limits. Designing permissions first is what keeps them out of the prompt.

Mark complete