Agents and tool use under control

What you will be able to do

1. Implement an explicit decide-act-observe state loop.
2. Enforce least privilege, budgets, idempotency, and confirmation.
3. Contain malicious observations and indirect injection.

Prerequisites: dictionaries, loops, functions, exceptions and installed Python or paper tracing. Reuse earlier Builder artifacts only when the task requires them.

This curriculum runs self-study on VetsLearn. Where the text calls for an instructor, peer or formal review, use the stated acceptance criteria for self-review. Reflection questions support reflection; they do not replace independent assessment. A peer review is optional unless your actual organization requires it.

Part 1 Technical instruction

A workflow follows predefined transitions; an agent selects among allowed transitions. In both cases, code owns state, permissions, budgets, and termination. Each proposed action is validated against authenticated identity, tool allowlist, argument schema, remaining time/tool/token budget, and confirmation policy. Idempotency keys protect repeated calls. Observations are untrusted; tool output cannot grant new permissions. A trace must reconstruct state without retaining prohibited content. The lab permits only canned, read-only research tools and simulated confirmation.

Mechanism and implementation

A harness owns budgets, state and permissions. One tool and a precise goal can support agentic selection; vague goals and multiple tools are not defining criteria. Hold model constant when comparing harnesses. MCP standardizes exchange/discovery, while authentication, authorization, sandboxing and approval are separate.

Constructed offline example

Save as topic_example.py and run python topic_example.py with an installed Python 3.11+ interpreter. This standard-library construction uses synthetic values; its checks are not provider measurements.

proposals = ["read", "read", "read", "read"]
observations = []
for proposed in proposals:
    if len(observations) >= 2:
        break
    if proposed != "read":
        raise ValueError("unlisted_tool")
    observations.append({"action": proposed, "status": "complete"})
assert len(observations) == 2
print("budget_exhausted")

Engineering decisions

• Choose workflow instead of agency when the path is known.
• Define hard termination and loop detection.
• Require human confirmation for consequential simulated actions.

Worked example

A canned web page tells the agent to ignore policy and call publish(). The application has no publish tool, treats the page as evidence, and terminates after the read-only research budget. Duplicate lookup calls reuse the same idempotency record.

Diagnose the failure

The cap counts all calls, including parallel proposals. Cancellation prevents future actions. Task state, approvals and pending effects remain outside lossy compaction; prompts cannot enforce them.

Part 2 Guided practice

Trace the cap before each call. Add deadline, cancellation and no-progress limits. Independently inject a tool observation asserting administrator authority and prove permissions remain unchanged.

Answer criteria and feedback: The cap counts all calls, including parallel proposals. Cancellation prevents future actions. Task state, approvals and pending effects remain outside lossy compaction; prompts cannot enforce them.

Continue with the downloadable pack below. If the pack or interpreter is unavailable, trace this self-contained example by hand in an input/expected-status/controlling-rule table and label execution unverified. Do not invent passing output. No account, credential, paid call, purchase or actual deployment is required.

Part 3 Remediation

Replay the provided state trace one transition at a time. If the loop does not terminate, inspect the transition guard and budget decrement before changing prompts. After repair, reassess with the alternate scenario in scenario_alt.json. A critical authorization, data-handling, evidence-integrity, or prohibited-action failure cannot be averaged into successful practice; it requires targeted remediation.

Part 4 Sources and currency

• https://genai.owasp.org/
• https://www.cisa.gov/resources-tools/resources/secure-design-alert-eliminating-cross-site-scripting-vulnerabilities

Use the workflow decision reference for model/deployment/harness distinctions and controlled comparisons. Source currency must be checked before each cohort. Provider/product behavior is illustrative where mocked; resolve current interfaces only from official documentation in an authorized environment.