Least privilege and idempotency
The role comes from the session, never from arguments the model wrote.
Tools that change the world (refund, delete, send, deploy) turn a model mistake or a hostile instruction into a real incident. Separate read from write, ask a human before side effects, give each tool the least power it needs, make writes safe to repeat, and keep an audit log.
Change the code and press Run (Ctrl+Enter). Predict what will happen first, then break it on purpose and read what changes. Your edits are saved and match the lesson page.
Ready for more? This phase has 6 hands-on exercises with automatic checks.
Practice questions
Write the code in the editor, run it, then open the model answer to compare.
Write needs_confirmation(risk) that returns True for "write" and "destructive" and False for "read". Make unknown risks need confirmation (fail closed).
Write audit_line(call_id, tool, decision) that returns "<call_id> <tool> <decision>" and Audit with add(line) and count(decision) that counts lines ending in the decision.
Explain it without notes
Why do read tools and write tools need different treatment in a tool runner?
What is least privilege for a tool, with an example?
What is an idempotency key and why do tool loops need it?
Expected output
1 support refund_order: refunded 20 on A17
2 support refund_order: already done (same idempotency key)
3 support refund_order: refused: 80 is above the limit 50 for support
4 manager refund_order: refunded 80 on A18
5 support delete_account: refused: support may not use delete_account