Agent Tool Capabilities
Tool authorization by argument, resource, expiry and atomic call and byte budgets, with verifiable denial and revocation records.
Problem and relevance to agents
A tool name does not constrain its arguments, resource access or cost. Concurrent requests can overspend a budget unless authorization is enforced before effects.
An agent receives only execution authority while a trusted host retains issuance, revocation and tool registration.
Architecture
- Issue bounded grants. Opaque process-local bearer tokens refer to immutable tool, argument, virtual-resource and expiry scopes.
- Reserve atomically. A shared admission lock validates scope and revocation and reserves both call and input-byte budgets before a callback executes.
- Record decisions. Immutable ordered records omit tokens and argument values. Denials leave the synthetic note store unchanged.
What this demonstrates
- Atomic budget checks under two eight-thread races.
- Strict argument constraints and resource canonicalization before callbacks.
- Revocation ordering with explicit treatment of already admitted work.
Published results
The local fixed experiment contains 25 sequential cases, two 64-attempt races and an event-controlled in-flight revocation.
Sequential cases replay against owned in-memory note tools. Concurrency evidence records admissions, denials and resource effects; the verifier checks arithmetic without reproducing the historical schedule.
Admission and revocation checks
| Check | Observed result |
|---|---|
| Permitted sequential controls | 3/3 admitted |
| Adversarial or exhausted cases | 22/22 denied |
| Denied calls changing the store | 0/22 |
| Call-budget race, 64 attempts | 7 admitted, 57 denied |
| Byte-budget race, 64 attempts | 7 admitted, 57 denied |
| Revocation | Admitted call finished; subsequent call denied |
The experiment confirms these synthetic cases, not general attack resistance. It makes no throughput, latency or independent security-audit claim.
Reproduce
Python 3.11 or newer, with no runtime dependencies.
Run measurements in a new destination and serialize heavy workloads. Within the original project series, use the shared benchmark_lock.py wrapper. Commands below use POSIX shell syntax.
Verify saved evidence
git clone https://github.com/lucioduran/agent-tool-capabilities.git
cd agent-tool-capabilities
git checkout f4d3df5ea1399da44f6eb90050933b32d3782918
python -m experiments.verify results/reference.jsonRepeat the local experiment
python -m experiments.reproduce --output build/new-run.json
python -m experiments.verify build/new-run.jsonScope and limitations
- Arbitrary Python in the broker process can bypass this application authorization boundary. It is not an operating-system sandbox.
- Bearer-token theft transfers remaining authority. Grants are process-local, without authentication, persistence or distributed enforcement.
- Virtual resource paths do not enforce filesystem symlink, URL redirect or operating-system boundaries.
- Revocation does not cancel admitted calls. Failures consume budgets and may leave partial effects. Audit records are in memory, unbounded and unsigned.
Sources and revision
The timestamp, clean implementation revision, source hashes and hardware are recorded in the reference report. The release adds publication artifacts; hashes establish consistency rather than authenticity.
- Reviewed revision:
f4d3df5ea1399da44f6eb90050933b32d3782918 - Revision recorded by the experiment:
7397b9c40f0f284c108f584966b8d6c803ebebcd - Report timestamp (UTC):
- Release published: v1.0.0 ·