Permission controls

An agent with a shell is powerful and terrifying. Nobody wants a bot to rm -rf the home directory because the model hallucinated a cleanup step. The fix is a three-tier model: some commands always safe, some always blocked, and everything in between gated by a persistent allowlist.

Flashcards: Flashcards

Loading practice…

05-permission-controls/bot.py

python

import re

SAFE_COMMANDS = {'ls', 'pwd', 'whoami', 'date', 'echo', 'cat', 'wc'}
DANGEROUS_PATTERNS = [
    r'\brm\s+-rf\b',
    r'\bsudo\b',
    r'curl\s+.*\|\s*(bash|sh)',
    r'>\s*/dev/sd',
]

def check_command_safety(command: str) -> str:
    first_word = command.strip().split()[0] if command.strip() else ''
    if first_word in SAFE_COMMANDS:
        return 'safe'
    for pattern in DANGEROUS_PATTERNS:
        if re.search(pattern, command):
            return 'blocked'
    if command in load_approvals():
        return 'safe'
    return 'needs_approval'

Three outcomes, decided in this order: allowlist, then denylist, then a check against saved approvals, then ask the user.

You can, and you should. But a prompt is a suggestion, not a guarantee. A permission layer is code that runs no matter what the model decides. Defense in depth beats polite instructions every single time something goes wrong.

Quiz: Quiz

Loading practice…