← Lesson
Permissions and Least Privilege
Joeven
Run
Reset
Python loads on first run
import json TOOLS = { "search": lambda q: {"hits": ["12 C in Oslo"]}, "refund": lambda invoice_id: {"ok": True, "invoice_id": invoice_id}, "run_shell": lambda cmd: {"oh_no": cmd}, } POLICY = {"allowed": {"search", "refund"}, "max_refunds": 1} session = {"refunds": 0} def execute(name, args): if name not in POLICY["allowed"]: return {"error": "denied", "reason": "tool not on allowlist", "name": name} if name == "refund": if session["refunds"] >= POLICY["max_refunds"]: return {"error": "denied", "reason": "session refund cap"} session["refunds"] += 1 return {"ok": True, "result": TOOLS[name](**args)} print("search", execute("search", {"q": "Oslo weather"})) print("refund", execute("refund", {"invoice_id": "INV-17"})) print("cap", execute("refund", {"invoice_id": "INV-18"})) print("shell", execute("run_shell", {"cmd": "rm -rf /"})) print("audit", json.dumps(session))
Run to execute this in your browser. Nothing is sent to a server.