Tool permission boundaries in Agentic AI - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a tool permission boundary that restricts access to only approved tools.

Agentic AI

tool_permissions = [1](['search', 'calculator'])

Drag options to blanks, or click blank then click option'

Alist

Btuple

Cdict

Dset

Attempts:

3 left

💡 Hint

Common Mistakes

Using a list instead of a set can cause slower permission checks.

Using a dict or tuple is not suitable for membership testing in this context.

We use a set to define tool permissions because it allows fast membership checks and ensures unique tools.

2fill in blank

medium

Complete the code to check if the tool 'email' is allowed by the permission boundary.

Agentic AI

if 'email' [1] tool_permissions:
    print('Access granted')
else:
    print('Access denied')

Drag options to blanks, or click blank then click option'

A==

Bnot in

Cin

D!=

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' or '!=' compares values incorrectly here.

Using 'not in' reverses the logic and denies access when it should grant.

The 'in' keyword checks if 'email' is a member of the tool_permissions set.

3fill in blank

hard

Fix the error in the code that attempts to add a new tool 'calendar' to the permission boundary.

Agentic AI

tool_permissions.[1]('calendar')

Drag options to blanks, or click blank then click option'

Ainsert

Badd

Cappend

Dextend

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'append' causes an AttributeError because sets do not have this method.

Using 'insert' or 'extend' are list methods and not valid for sets.

Sets use the 'add' method to include new elements, unlike lists which use 'append'.

4fill in blank

hard

Fill both blanks to create a function that returns True if a tool is allowed, False otherwise.

Agentic AI

def is_tool_allowed(tool):
    return tool [1] tool_permissions [2] True

Drag options to blanks, or click blank then click option'

Ain

B==

Cis

D!=

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'is' instead of '==' can cause unexpected behavior.

Using '!=' reverses the logic and returns incorrect results.

The function checks if the tool is in the permissions set and compares the result to True for clarity.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension that maps each tool to a boolean indicating permission.

Agentic AI

tool_access = {tool: tool [1] tool_permissions [2] True for tool in tools if tool [3] tool_permissions}

Drag options to blanks, or click blank then click option'

Ain

B==

Cnot in

D!=

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'not in' in the filter excludes allowed tools incorrectly.

Using '!=' reverses the logic and causes wrong mappings.

The comprehension checks membership with 'in', compares to True, and filters tools that are in permissions.

Practice

1. What is the main purpose of tool permission boundaries in agentic AI systems?

easy

A. To limit what actions AI tools can perform

B. To increase the speed of AI computations

C. To improve the visual design of AI interfaces

D. To store large amounts of data efficiently

Solution

1. Step 1: Understand the role of permission boundaries

   Permission boundaries restrict the actions AI tools can take to ensure safety and control.

2. Step 2: Identify the main goal

   The main goal is to limit actions to prevent harmful or unauthorized behavior.

3. Final Answer:

   To limit what actions AI tools can perform -> Option A

4. Quick Check:

   Permission boundaries = limit actions [OK]

Hint: Permission boundaries control AI actions to keep systems safe [OK]

Common Mistakes:

• Confusing permission boundaries with data storage
• Thinking permission boundaries speed up AI
• Assuming permission boundaries affect UI design

2. Which of the following is the correct way to define a permission boundary for an AI tool in pseudocode?

easy

A. permissions = 'full_access'

B. allow_actions = ['read', 'write', 'execute']

C. actions = ['all']

D. permission_boundary = { 'allowed': ['read', 'write'], 'denied': ['delete'] }

Solution

1. Step 1: Identify correct permission boundary structure

   A permission boundary should clearly specify allowed and denied actions.

2. Step 2: Compare options

   permission_boundary = { 'allowed': ['read', 'write'], 'denied': ['delete'] } explicitly defines allowed and denied actions, which fits permission boundary concept.

3. Final Answer:

   permission_boundary = { 'allowed': ['read', 'write'], 'denied': ['delete'] } -> Option D

4. Quick Check:

   Permission boundary = allowed and denied actions [OK]

Hint: Look for explicit allowed and denied lists in permission definitions [OK]

Common Mistakes:

• Using vague permissions like 'all' or 'full_access'
• Not specifying denied actions
• Confusing action lists with permission boundaries

3. Given this pseudocode for an AI tool permission check:

def can_perform(action, permissions):
    return action in permissions['allowed'] and action not in permissions['denied']

permissions = {'allowed': ['read', 'write'], 'denied': ['delete']}
action = 'delete'
print(can_perform(action, permissions))

What will be the output?

medium

A. True

B. False

C. Error

D. None

Solution

1. Step 1: Understand the function logic

   The function returns True only if action is in allowed and not in denied.

2. Step 2: Check the action 'delete'

   'delete' is not in allowed but is in denied, so condition fails.

3. Final Answer:

   False -> Option B

4. Quick Check:

   Action denied = False output [OK]

Hint: Check if action is both allowed and not denied for True [OK]

Common Mistakes:

• Ignoring denied list and returning True
• Assuming 'delete' is allowed by default
• Confusing function return values

4. Identify the error in this permission boundary check code:

def check_permission(action, permissions):
    if action in permissions['allowed'] or action not in permissions['denied']:
        return True
    else:
        return False

permissions = {'allowed': ['read'], 'denied': ['delete']}
print(check_permission('delete', permissions))

medium

A. Incorrect dictionary keys

B. Missing return statement

C. Using 'or' instead of 'and' in condition

D. Syntax error in function definition

Solution

1. Step 1: Analyze the condition logic

   The condition uses 'or' which allows action if either allowed or not denied.

2. Step 2: Understand correct logic for permission

   It should be 'and' to ensure action is allowed and not denied simultaneously.

3. Final Answer:

   Using 'or' instead of 'and' in condition -> Option C

4. Quick Check:

   Permission check needs 'and' not 'or' [OK]

Hint: Permission checks require 'and' to combine allowed and denied rules [OK]

Common Mistakes:

• Using 'or' allowing denied actions
• Confusing dictionary keys
• Forgetting to return a value

5. You want to design a permission boundary for an AI tool that can read and write files but must never delete or modify system files. Which permission boundary setup below best enforces this?

hard

A. {'allowed': ['read', 'write'], 'denied': ['delete', 'modify_system_files']}

B. {'allowed': ['read', 'write', 'delete'], 'denied': ['modify_system_files']}

C. {'allowed': ['read'], 'denied': ['write', 'delete', 'modify_system_files']}

D. {'allowed': ['read', 'write', 'modify_system_files'], 'denied': ['delete']}

Solution

1. Step 1: Identify required allowed actions

   The tool must be allowed to read and write files.

2. Step 2: Identify denied actions

   It must never delete or modify system files, so these must be denied.

3. Step 3: Match options to requirements

   {'allowed': ['read', 'write'], 'denied': ['delete', 'modify_system_files']} allows read and write, denies delete and modify_system_files, matching requirements exactly.

4. Final Answer:

   {'allowed': ['read', 'write'], 'denied': ['delete', 'modify_system_files']} -> Option A

5. Quick Check:

   Allowed read/write, denied delete/system modify = {'allowed': ['read', 'write'], 'denied': ['delete', 'modify_system_files']} [OK]

Hint: Match allowed and denied lists exactly to requirements [OK]

Common Mistakes:

• Allowing delete when it should be denied
• Denying write when it should be allowed
• Missing deny for system file modifications