VetsLearn — Build & automate — 04: Enforce tool permissions and preserve denial
Revision 2026-10-03; fictional training fixture.

OUTCOME
Implement a dispatcher that cannot turn a denied read into evidence.

INDEPENDENT TASK
Independent lab stage: implement lookup in starter.py using the supplied caller and record fixtures. Test guest/public, guest/restricted, absent ID and invalid arguments.

STEPS
1. Validate the request before record access.
2. Apply record scope from trusted fixture metadata.
3. Return explicit status and no restricted payload on denial.

ACCEPTANCE CRITERIA
- Guest cannot read R.
- Missing records and invalid requests are handled.
- Restricted contents never enter guest results.

EXPLAIN YOUR APPROACH
Which identifiers and authorization facts would require stronger treatment in production?

Keep your artifact, corrections, evidence and limitations yourself.
Self-review is not independent assessment. No paid model calls are required.
Review notes: /paths/builder/04/#practice