{"schemaVersion":1,"id":"https://lucioduran.com/projects/agent-tool-capabilities","url":"https://lucioduran.com/projects/agent-tool-capabilities","title":"Agent Tool Capabilities","description":"Tool authorization by argument, resource, expiry and atomic call and byte budgets, with verifiable denial and revocation records.","language":"en","datePublished":"2026-11-09","dateModified":"2026-11-09","contentFormat":"text/markdown","content":"[Projects](<https://lucioduran.com/projects>) / Agent Tool Capabilities\n\n# Agent Tool Capabilities\n\nTool authorization by argument, resource, expiry and atomic call and byte budgets, with verifiable denial and revocation records.\n\nAuthor: [Lucio Durán](<https://lucioduran.com/>) · Python 3.11.13 · License: [MIT](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/LICENSE>)\n\nPage published: 2026-11-09 · Page updated: 2026-11-09\n\n[Repository](<https://github.com/lucioduran/agent-tool-capabilities>) · [Original evidence](<https://raw.githubusercontent.com/lucioduran/agent-tool-capabilities/f4d3df5ea1399da44f6eb90050933b32d3782918/results/reference.json>) · [Release v1.0.0](<https://github.com/lucioduran/agent-tool-capabilities/releases/tag/v1.0.0>)\n\n## Problem and relevance to agents\n\nA tool name does not constrain its arguments, resource access or cost. Concurrent requests can overspend a budget unless authorization is enforced before effects.\n\nAn agent receives only execution authority while a trusted host retains issuance, revocation and tool registration.\n\n## Architecture\n\n1. **Issue bounded grants.** Opaque process-local bearer tokens refer to immutable tool, argument, virtual-resource and expiry scopes.\n2. **Reserve atomically.** A shared admission lock validates scope and revocation and reserves both call and input-byte budgets before a callback executes.\n3. **Record decisions.** Immutable ordered records omit tokens and argument values. Denials leave the synthetic note store unchanged.\n\n- [Design and trust boundaries](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/docs/design.md>)\n\n## What this demonstrates\n\n- Atomic budget checks under two eight-thread races.\n- Strict argument constraints and resource canonicalization before callbacks.\n- Revocation ordering with explicit treatment of already admitted work.\n\n## Published results\n\nThe local fixed experiment contains 25 sequential cases, two 64-attempt races and an event-controlled in-flight revocation.\n\nSequential cases replay against owned in-memory note tools. Concurrency evidence records admissions, denials and resource effects; the verifier checks arithmetic without reproducing the historical schedule.\n\n### Admission and revocation checks\n\n| Check | Observed result |\n| --- | --- |\n| Permitted sequential controls | 3/3 admitted |\n| Adversarial or exhausted cases | 22/22 denied |\n| Denied calls changing the store | 0/22 |\n| Call-budget race, 64 attempts | 7 admitted, 57 denied |\n| Byte-budget race, 64 attempts | 7 admitted, 57 denied |\n| Revocation | Admitted call finished; subsequent call denied |\n\nThe experiment confirms these synthetic cases, not general attack resistance. It makes no throughput, latency or independent security-audit claim.\n\n## Reproduce\n\nPython 3.11 or newer, with no runtime dependencies.\n\nRun measurements in a new destination and serialize heavy workloads. Within the original project series, use the shared benchmark\\_lock.py wrapper. Commands below use POSIX shell syntax.\n\n### Verify saved evidence\n\n```\ngit clone https://github.com/lucioduran/agent-tool-capabilities.git\ncd agent-tool-capabilities\ngit checkout f4d3df5ea1399da44f6eb90050933b32d3782918\npython -m experiments.verify results/reference.json\n```\n\n### Repeat the local experiment\n\n```\npython -m experiments.reproduce --output build/new-run.json\npython -m experiments.verify build/new-run.json\n```\n\n## Scope and limitations\n\n- Arbitrary Python in the broker process can bypass this application authorization boundary. It is not an operating-system sandbox.\n- Bearer-token theft transfers remaining authority. Grants are process-local, without authentication, persistence or distributed enforcement.\n- Virtual resource paths do not enforce filesystem symlink, URL redirect or operating-system boundaries.\n- Revocation does not cancel admitted calls. Failures consume budgets and may leave partial effects. Audit records are in memory, unbounded and unsigned.\n\n- [Related architecture article](<https://lucioduran.com/blog/capability-based-security-wasi-preview2>)\n\n## Sources and revision\n\nThe timestamp, clean implementation revision, source hashes and hardware are recorded in the reference report. The release adds publication artifacts; hashes establish consistency rather than authenticity.\n\n- Reviewed revision: [` f4d3df5ea1399da44f6eb90050933b32d3782918 `](<https://github.com/lucioduran/agent-tool-capabilities/commit/f4d3df5ea1399da44f6eb90050933b32d3782918>)\n- Revision recorded by the experiment: [` 7397b9c40f0f284c108f584966b8d6c803ebebcd `](<https://github.com/lucioduran/agent-tool-capabilities/commit/7397b9c40f0f284c108f584966b8d6c803ebebcd>)\n- Report timestamp (UTC): 2026-11-09T18:28:21.140506+00:00\n- Release published: [v1.0.0](<https://github.com/lucioduran/agent-tool-capabilities/releases/tag/v1.0.0>) · 2026-11-09T18:31:17Z\n\n- [README and usage](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/README.md>)\n- [Original evidence](<https://raw.githubusercontent.com/lucioduran/agent-tool-capabilities/f4d3df5ea1399da44f6eb90050933b32d3782918/results/reference.json>)\n- [MIT license](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/LICENSE>)\n- [Design and trust boundaries](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/docs/design.md>)\n- [Measurement methodology](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/docs/evidence.md>)\n- [Recorded test coverage](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/results/coverage.txt>)","headings":[{"level":1,"text":"Agent Tool Capabilities","url":"https://lucioduran.com/projects/agent-tool-capabilities#title"},{"level":2,"text":"Problem and relevance to agents","url":"https://lucioduran.com/projects/agent-tool-capabilities#problem"},{"level":2,"text":"Architecture","url":"https://lucioduran.com/projects/agent-tool-capabilities#architecture"},{"level":2,"text":"What this demonstrates","url":"https://lucioduran.com/projects/agent-tool-capabilities#demonstrates"},{"level":2,"text":"Published results","url":"https://lucioduran.com/projects/agent-tool-capabilities#results"},{"level":3,"text":"Admission and revocation checks","url":"https://lucioduran.com/projects/agent-tool-capabilities#results-Admission%20and%20revocation%20checks"},{"level":2,"text":"Reproduce","url":"https://lucioduran.com/projects/agent-tool-capabilities#reproduce"},{"level":3,"text":"Verify saved evidence","url":"https://lucioduran.com/projects/agent-tool-capabilities#reproduce-replay"},{"level":3,"text":"Repeat the local experiment","url":"https://lucioduran.com/projects/agent-tool-capabilities#reproduce-experiment"},{"level":2,"text":"Scope and limitations","url":"https://lucioduran.com/projects/agent-tool-capabilities#scope"},{"level":2,"text":"Sources and revision","url":"https://lucioduran.com/projects/agent-tool-capabilities#sources"}],"sections":[{"heading":"Agent Tool Capabilities","level":1,"url":"https://lucioduran.com/projects/agent-tool-capabilities","content":"[Projects](<https://lucioduran.com/projects>) / Agent Tool Capabilities"},{"heading":"Agent Tool Capabilities","level":1,"url":"https://lucioduran.com/projects/agent-tool-capabilities#title","content":"Tool authorization by argument, resource, expiry and atomic call and byte budgets, with verifiable denial and revocation records.\n\nAuthor: [Lucio Durán](<https://lucioduran.com/>) · Python 3.11.13 · License: [MIT](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/LICENSE>)\n\nPage published: 2026-11-09 · Page updated: 2026-11-09\n\n[Repository](<https://github.com/lucioduran/agent-tool-capabilities>) · [Original evidence](<https://raw.githubusercontent.com/lucioduran/agent-tool-capabilities/f4d3df5ea1399da44f6eb90050933b32d3782918/results/reference.json>) · [Release v1.0.0](<https://github.com/lucioduran/agent-tool-capabilities/releases/tag/v1.0.0>)"},{"heading":"Problem and relevance to agents","level":2,"url":"https://lucioduran.com/projects/agent-tool-capabilities#problem","content":"A tool name does not constrain its arguments, resource access or cost. Concurrent requests can overspend a budget unless authorization is enforced before effects.\n\nAn agent receives only execution authority while a trusted host retains issuance, revocation and tool registration."},{"heading":"Architecture","level":2,"url":"https://lucioduran.com/projects/agent-tool-capabilities#architecture","content":"1. **Issue bounded grants.** Opaque process-local bearer tokens refer to immutable tool, argument, virtual-resource and expiry scopes.\n2. **Reserve atomically.** A shared admission lock validates scope and revocation and reserves both call and input-byte budgets before a callback executes.\n3. **Record decisions.** Immutable ordered records omit tokens and argument values. Denials leave the synthetic note store unchanged.\n\n- [Design and trust boundaries](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/docs/design.md>)"},{"heading":"What this demonstrates","level":2,"url":"https://lucioduran.com/projects/agent-tool-capabilities#demonstrates","content":"- Atomic budget checks under two eight-thread races.\n- Strict argument constraints and resource canonicalization before callbacks.\n- Revocation ordering with explicit treatment of already admitted work."},{"heading":"Published results","level":2,"url":"https://lucioduran.com/projects/agent-tool-capabilities#results","content":"The local fixed experiment contains 25 sequential cases, two 64-attempt races and an event-controlled in-flight revocation.\n\nSequential cases replay against owned in-memory note tools. Concurrency evidence records admissions, denials and resource effects; the verifier checks arithmetic without reproducing the historical schedule."},{"heading":"Admission and revocation checks","level":3,"url":"https://lucioduran.com/projects/agent-tool-capabilities#results-Admission%20and%20revocation%20checks","content":"| Check | Observed result |\n| --- | --- |\n| Permitted sequential controls | 3/3 admitted |\n| Adversarial or exhausted cases | 22/22 denied |\n| Denied calls changing the store | 0/22 |\n| Call-budget race, 64 attempts | 7 admitted, 57 denied |\n| Byte-budget race, 64 attempts | 7 admitted, 57 denied |\n| Revocation | Admitted call finished; subsequent call denied |\n\nThe experiment confirms these synthetic cases, not general attack resistance. It makes no throughput, latency or independent security-audit claim."},{"heading":"Reproduce","level":2,"url":"https://lucioduran.com/projects/agent-tool-capabilities#reproduce","content":"Python 3.11 or newer, with no runtime dependencies.\n\nRun measurements in a new destination and serialize heavy workloads. Within the original project series, use the shared benchmark\\_lock.py wrapper. Commands below use POSIX shell syntax."},{"heading":"Verify saved evidence","level":3,"url":"https://lucioduran.com/projects/agent-tool-capabilities#reproduce-replay","content":"```\ngit clone https://github.com/lucioduran/agent-tool-capabilities.git\ncd agent-tool-capabilities\ngit checkout f4d3df5ea1399da44f6eb90050933b32d3782918\npython -m experiments.verify results/reference.json\n```"},{"heading":"Repeat the local experiment","level":3,"url":"https://lucioduran.com/projects/agent-tool-capabilities#reproduce-experiment","content":"```\npython -m experiments.reproduce --output build/new-run.json\npython -m experiments.verify build/new-run.json\n```"},{"heading":"Scope and limitations","level":2,"url":"https://lucioduran.com/projects/agent-tool-capabilities#scope","content":"- Arbitrary Python in the broker process can bypass this application authorization boundary. It is not an operating-system sandbox.\n- Bearer-token theft transfers remaining authority. Grants are process-local, without authentication, persistence or distributed enforcement.\n- Virtual resource paths do not enforce filesystem symlink, URL redirect or operating-system boundaries.\n- Revocation does not cancel admitted calls. Failures consume budgets and may leave partial effects. Audit records are in memory, unbounded and unsigned.\n\n- [Related architecture article](<https://lucioduran.com/blog/capability-based-security-wasi-preview2>)"},{"heading":"Sources and revision","level":2,"url":"https://lucioduran.com/projects/agent-tool-capabilities#sources","content":"The timestamp, clean implementation revision, source hashes and hardware are recorded in the reference report. The release adds publication artifacts; hashes establish consistency rather than authenticity.\n\n- Reviewed revision: [` f4d3df5ea1399da44f6eb90050933b32d3782918 `](<https://github.com/lucioduran/agent-tool-capabilities/commit/f4d3df5ea1399da44f6eb90050933b32d3782918>)\n- Revision recorded by the experiment: [` 7397b9c40f0f284c108f584966b8d6c803ebebcd `](<https://github.com/lucioduran/agent-tool-capabilities/commit/7397b9c40f0f284c108f584966b8d6c803ebebcd>)\n- Report timestamp (UTC): 2026-11-09T18:28:21.140506+00:00\n- Release published: [v1.0.0](<https://github.com/lucioduran/agent-tool-capabilities/releases/tag/v1.0.0>) · 2026-11-09T18:31:17Z\n\n- [README and usage](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/README.md>)\n- [Original evidence](<https://raw.githubusercontent.com/lucioduran/agent-tool-capabilities/f4d3df5ea1399da44f6eb90050933b32d3782918/results/reference.json>)\n- [MIT license](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/LICENSE>)\n- [Design and trust boundaries](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/docs/design.md>)\n- [Measurement methodology](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/docs/evidence.md>)\n- [Recorded test coverage](<https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/results/coverage.txt>)"}],"links":[{"text":"Projects","url":"https://lucioduran.com/projects"},{"text":"Lucio Durán","url":"https://lucioduran.com/"},{"text":"MIT","url":"https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/LICENSE"},{"text":"Repository","url":"https://github.com/lucioduran/agent-tool-capabilities"},{"text":"Original evidence","url":"https://raw.githubusercontent.com/lucioduran/agent-tool-capabilities/f4d3df5ea1399da44f6eb90050933b32d3782918/results/reference.json"},{"text":"Release v1.0.0","url":"https://github.com/lucioduran/agent-tool-capabilities/releases/tag/v1.0.0"},{"text":"Design and trust boundaries","url":"https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/docs/design.md"},{"text":"Related architecture article","url":"https://lucioduran.com/blog/capability-based-security-wasi-preview2"},{"text":"f4d3df5ea1399da44f6eb90050933b32d3782918","url":"https://github.com/lucioduran/agent-tool-capabilities/commit/f4d3df5ea1399da44f6eb90050933b32d3782918"},{"text":"7397b9c40f0f284c108f584966b8d6c803ebebcd","url":"https://github.com/lucioduran/agent-tool-capabilities/commit/7397b9c40f0f284c108f584966b8d6c803ebebcd"},{"text":"v1.0.0","url":"https://github.com/lucioduran/agent-tool-capabilities/releases/tag/v1.0.0"},{"text":"README and usage","url":"https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/README.md"},{"text":"MIT license","url":"https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/LICENSE"},{"text":"Measurement methodology","url":"https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/docs/evidence.md"},{"text":"Recorded test coverage","url":"https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/results/coverage.txt"}],"structuredData":[{"@context":"https://schema.org","@graph":[{"@type":"Person","@id":"https://lucioduran.com/#person","name":"Lucio Durán","url":"https://lucioduran.com/"},{"@type":"WebSite","@id":"https://lucioduran.com/#website","url":"https://lucioduran.com/","name":"Lucio Durán","inLanguage":["en","es"],"publisher":{"@id":"https://lucioduran.com/#person"}},{"@type":"WebPage","@id":"https://lucioduran.com/projects/agent-tool-capabilities#page","url":"https://lucioduran.com/projects/agent-tool-capabilities","name":"Agent Tool Capabilities","description":"Tool authorization by argument, resource, expiry and atomic call and byte budgets, with verifiable denial and revocation records.","inLanguage":"en","author":{"@id":"https://lucioduran.com/#person"},"publisher":{"@id":"https://lucioduran.com/#person"},"isPartOf":{"@id":"https://lucioduran.com/#website"},"isAccessibleForFree":true,"mainEntity":{"@id":"https://lucioduran.com/projects/agent-tool-capabilities#software"},"datePublished":"2026-11-09","dateModified":"2026-11-09","breadcrumb":{"@id":"https://lucioduran.com/projects/agent-tool-capabilities#breadcrumb"}},{"@type":"SoftwareSourceCode","@id":"https://lucioduran.com/projects/agent-tool-capabilities#software","name":"Agent Tool Capabilities","description":"Tool authorization by argument, resource, expiry and atomic call and byte budgets, with verifiable denial and revocation records.","inLanguage":"en","url":"https://lucioduran.com/projects/agent-tool-capabilities","codeRepository":"https://github.com/lucioduran/agent-tool-capabilities","programmingLanguage":"Python","runtimePlatform":"Python 3.11.13","license":"https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/LICENSE","version":"v1.0.0","identifier":{"@type":"PropertyValue","propertyID":"git-commit","value":"f4d3df5ea1399da44f6eb90050933b32d3782918"},"author":{"@type":"Person","@id":"https://lucioduran.com/#person","name":"Lucio Durán","url":"https://lucioduran.com"},"isAccessibleForFree":true,"citation":["https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/README.md","https://raw.githubusercontent.com/lucioduran/agent-tool-capabilities/f4d3df5ea1399da44f6eb90050933b32d3782918/results/reference.json","https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/docs/design.md","https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/docs/evidence.md","https://github.com/lucioduran/agent-tool-capabilities/blob/f4d3df5ea1399da44f6eb90050933b32d3782918/results/coverage.txt","https://github.com/lucioduran/agent-tool-capabilities/releases/tag/v1.0.0"],"publisher":{"@id":"https://lucioduran.com/#person"},"mainEntityOfPage":{"@id":"https://lucioduran.com/projects/agent-tool-capabilities#page"}},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Projects","item":"https://lucioduran.com/projects"},{"@type":"ListItem","position":2,"name":"Agent Tool Capabilities","item":"https://lucioduran.com/projects/agent-tool-capabilities"}],"@id":"https://lucioduran.com/projects/agent-tool-capabilities#breadcrumb"}]}],"contentHash":"fa8aa56fb1a788327b91df83fb2881b8ba51eb8b67f7ec6e741fc5f2cb81d10a","provenance":{"method":"Deterministic serialization of the server-rendered main element","source":"https://lucioduran.com/projects/agent-tool-capabilities","hashAlgorithm":"sha256","hashScope":"JSON document fields before contentHash and provenance","sourceHTMLBytes":42239,"contentBytes":5820}}