LLM Agent Permissions in Python: Block Risky Tool Calls

Key Takeaways

Agents should not get root access to your tools. This is the workflow you'll know how to run when we're done, which applies policy allow lists and [music] risk tiers to block unsafe tool calls. I'm Professor Pi, teaching AI engineering and LLM [music] systems with simple Python. Large language models are great at planning and at [music] calling external tools. That power becomes a liability when an agent can call anything. The usual failure mode is overreach. An agent tries to delete data or write secrets or call expensive APIs for convenience. Least privilege means stop those [music] calls before they run. Success looks like agents that still get work done, but only with explicitly [music] allowed capabilities. Think of least privilege as a simple filtering layer. You give each tool a risk label. You map roles and intents to allowed [music] risk levels. Then you gate planned calls against that [music] mapping. The idea is to stop risky actions early, not to audit them after the fact. That [music] reduces accidents, reduces cost, and makes incidents easier to trace. We will build a tiny progressive system. First we make a basic risk allow list. Then we add intent awareness. Next we automatically pick safer substitutes. After that we add a costware risk threshold. Finally we log compact incident IDs for blocked calls. Each step is small and reusable, and you can combine them in a real agent pipeline. Now, we'll create the basic allow list and block tool calls that exceed a ROS's permitted risks. This snippet builds a tiny risk tier allow list to restrict which tools an agent may [music] call. The dictionary tools assigns a risk to each tool, such as low for read [music] and critical for delete. The variable role holds the actor [music] identity and allowed risks maps that role to the permitted risk levels. The list plan represents [music] the agents intended calls in sequence. The list allowed filters planned to only those tools whose risk is permitted while blocked captures the rest. The final count shows how many calls were allowed versus blocked. The printed totals confirm least privilege gating is applied before any [music] execution. Next, we'll make permissions depend on why the call is being made, not just [music] who asks for it. This example adds intent awareness. So, permissions depend on why a call is made. The tools mapping assigns risks while allowed [music] by intent lists which risk levels are acceptable per intent such as readon [music] permitting only low. The function gate checks whether the tools risk is allowed for the given intent [music] and role. The list calls holds planned tool intent pairs to evaluate. The list [music] passed keeps only those pairs approved by gate and the print statement compares approved [music] to total. The result shows that a delete attempt fails under a readonly intent [music] enforcing least privilege by context. Now we'll let the system replace [music] risky picks with safer alternatives automatically. This code chooses the least risky allowed tool for each intent replacing risky proposals. The dictionary risk rank gives each risk a numeric order to compare safety. The mappings tools and allowed by intent define tool risks and permitted risks per intent while alts lists candidate tools that can satisfy each intent. The function choose tool returns the safest permitted option by filtering alts against allowed by intent [music] and taking the minimum by risk rank. The list proposed simulates the [music] agents initial picks and chosen contains the policy compliant substitutions. The printed values show one swap occurred and which safer tool was selected first, demonstrating automatic least privilege substitution. Next, we'll add a tunable [music] threshold so teams can trade safety for speed or cost. This snippet adds [music] a tunable risk threshold to block higher risk, higher cost tool calls. The dictionary's tools and cost define each [music] tool's risk and unit cost. The mapping risk rank assigns numeric severity, so comparisons are simple. The variable risk limit sets the maximum [music] permitted risk. Allowed includes only tools at or below that level. The variable [music] saved sums the costs of block tools in the plan. Modeling spend avoided by pre-execution gating. [music] Increasing risk limit allows more tools, reducing saved but speeding throughput. [music] Decreasing it blocks more. Increasing saved but possibly limiting functionality. [music] The printed savings quantify the protection's financial impact from least privilege controls. Finally, we'll ensure every blocked request gets a compact incident ID for auditing. This example logs a compact incident identifier whenever a risky call is blocked. The dictionary tools assigns risks and allowed lists which risks are acceptable per intent. The list Rex contains proposed tool intent pairs to evaluate. The loop checks each request against the policy and for any [music] violation computes a short MD5based hash from hashlib to serve as an incident ID. The variable [music] blocked collects these IDs for later debugging and auditing. The final print [music] shows how many incidents occurred and the first incident identifier making blocked actions traceable without executing them. You can map this toy flow directly into a [music] real agent system. Use the same allow list checks before you call [music] any external API. Use intent labels from your planner. Store incident IDs in [music] your audit log and link them to the original request that gives a clear trail without revealing sensitive arguments. Recap. [music] Least privilege is a pre-execution filter that maps tools to risk tiers. Use it when agents [music] plan or request tool calls, especially for destructive or paid operations. Caveat: Overly strict rules can block legitimate behavior, so tune carefully. Next [music] step, tune the risk threshold and substitution policy to match [music] your risk appetite and operational cost. Try raising or lowering the risk limit and measure blocked calls and [music] saved cost. If short practical AI engineering helps, subscribe and watch the AI engineering