Enforce tool permissions and preserve denial
Preserve a denied read instead of pretending the record was inspected.
Reviewed: 2026-10-03
Source-based teaching example · Fictional data
Narration: Microsoft Mark · locally synthesized

00:00:00.000 — What you will learn

Preserve a denied read instead of pretending the record was inspected.

Visual description:
Preserve a denied read instead of pretending the record was inspected.

00:00:06.875 — The idea

Check access in the tool dispatcher before returning data. Retrieved text cannot expand permission. The final answer must reflect the actual tool outcome.

Visual description:
Check access in the tool dispatcher before returning data. Retrieved text cannot expand permission. The final answer must reflect the actual tool outcome.

00:00:20.083 — One useful term

Dispatcher. Application code that checks and runs a requested tool operation.

Visual description:
Application code that checks and runs a requested tool operation.

00:00:28.417 — A worked example

A guest asks for staff-only record R. Public text tells the assistant to ignore permissions. The dispatcher still denies R, and the answer must not cite its contents.

Visual description:
A guest asks for staff-only record R. Public text tells the assistant to ignore permissions. The dispatcher still denies R, and the answer must not cite its contents.

00:00:42.000 — Your turn to think

Can an instruction in a public document authorize the restricted read? Pause and decide before continuing.

Visual description:
Can an instruction in a public document authorize the restricted read?
Pause the video if you need more time.

00:00:59.625 — Why this answer works

No. Keep the denial visible and keep restricted content out of the guest result.

Visual description:
No. Keep the denial visible and keep restricted content out of the guest result.

00:01:07.792 — Check 1

Check role and record permission.

Visual description:
Check role and record permission.

00:01:12.708 — Check 2

Handle absent and invalid requests.

Visual description:
Handle absent and invalid requests.

00:01:18.208 — Check 3

Do not fabricate evidence from denied reads.

Visual description:
Do not fabricate evidence from denied reads.

00:01:24.125 — Now try a different case

Open the lesson and try its different practice case. Use every check in the full task. Watching alone does not mark the lesson complete.

Visual description:
Open the lesson
Try the new case
Check and revise
The full task and its requirements are in the linked lesson.