Watch the explanation. Practice the skill.
Enforce tool permissions and preserve denial
Preserve a denied read instead of pretending the record was inspected.
Captions appear here during playback.
Enforce tool permissions and preserve denial
Preserve a denied read instead of pretending the record was inspected.
Video playback is unavailable. Read the descriptive transcript below, go directly to practice, or open the video file.
Source-based teaching example · Fictional data · Reviewed 2026-10-03. Microsoft Mark · locally synthesized. On a small screen, use fullscreen for diagram details or read the transcript.
Read the descriptive transcript
0:00 · What you will learn
Preserve a denied read instead of pretending the record was inspected.
What appears on screen
Preserve a denied read instead of pretending the record was inspected.
0:06 · The idea
Check access in the tool dispatcher before returning data. Retrieved text cannot expand permission. The final answer must reflect the actual tool outcome.
What appears on screen
Check access in the tool dispatcher before returning data. Retrieved text cannot expand permission. The final answer must reflect the actual tool outcome.
0:20 · One useful term
Dispatcher. Application code that checks and runs a requested tool operation.
What appears on screen
Application code that checks and runs a requested tool operation.
0:28 · A worked example
A guest asks for staff-only record R. Public text tells the assistant to ignore permissions. The dispatcher still denies R, and the answer must not cite its contents.
What appears on screen
A guest asks for staff-only record R. Public text tells the assistant to ignore permissions. The dispatcher still denies R, and the answer must not cite its contents.
0:42 · Your turn to think
Can an instruction in a public document authorize the restricted read? Pause and decide before continuing.
What appears on screen
Can an instruction in a public document authorize the restricted read? Pause the video if you need more time.
0:59 · Why this answer works
No. Keep the denial visible and keep restricted content out of the guest result.
What appears on screen
No. Keep the denial visible and keep restricted content out of the guest result.
1:07 · Check 1
Check role and record permission.
What appears on screen
Check role and record permission.
1:12 · Check 2
Handle absent and invalid requests.
What appears on screen
Handle absent and invalid requests.
1:18 · Check 3
Do not fabricate evidence from denied reads.
What appears on screen
Do not fabricate evidence from denied reads.
1:24 · Now try a different case
Open the lesson and try its different practice case. Use every check in the full task. Watching alone does not mark the lesson complete.
What appears on screen
Open the lesson Try the new case Check and revise The full task and its requirements are in the linked lesson.
Watching explains the example. Complete the lesson practice to check what you can do. Explore all visual lessons →