Stage 4 of 7 · scoped · about 30 min
Two travelers, then a handoff
Goal. First isolate Alice from Bob; then observe why passing a whole credential gives the next agent too much.
Bob is going to Seattle on DL331, at the same time, through the same agents. Your stage 3 policy describes only Alice's Cancún flight, so Bob is rejected by destination, flight-budget, and reservation rules.
This stage has two acts. First isolate Alice from Bob. Then observe an intentional handoff leak. The red handoff checks in Act 2 do not mean your Act 1 solution is broken.
// One shared role now covers both flight jobs.
"flight-agent": {
actions: ["traveler.read", "search_flights", "book_flight", "wallet.charge"],
maxPrice: 450, // no destination: CUN and SEA both pass
maxCharge: 450,
profileFields: ["passportNumber"],
},
"checkin-agent": {
actions: ["get_reservation", "check_in", "issue_boarding_pass"],
reservations: ["UA214", "DL331"],
},Do this
-
Act 1 — isolate Alice and Bob. Run both trips. Read THE TRIP from top to bottom and notice every Alice-only assumption that rejects Bob.
npm run labWhat you should see npm run lab · 67 lines
Stage 4 of 7: Two travelers, then a handoff mode=scoped scenario=two-travelers guide: https://tenuo.ai/lab/stage-4 ACT 1 — ISOLATE THE TRIPS Bob is going to Seattle through the same agents. Alice's policy assumptions reject several parts of his trip. Fix them, then make sure Alice's agent cannot touch Bob's reservation (and vice versa). ACT 2 — WATCH THE HANDOFF LEAK The red handoff checks are intentional; your Act 1 solution is not broken. Check-in Agent hands Boarding Agent its whole credential because that is all it has to give. Find `central_calls` in `npm run trace` and write down, in one sentence, what your fix depends on. WALLET Alice: $914 of $1200 Bob: $1500 of $1500 ROGUE ATTEMPTS BLOCKED 7 / 7 STARS ☆★☆☆ ☆ Trip booked ★ Rogue stopped ☆ Tight handoff ☆ No spare authority 1 trip travel-agent trip-alice-cun traveler.read name ALLOWED 2 trip travel-agent trip-alice-cun calendar.create * ALLOWED 3 trip flight-agent trip-alice-cun traveler.read passportNumber ALLOWED 4 trip flight-agent trip-alice-cun search_flights CUN ALLOWED 5 trip flight-agent trip-alice-cun book_flight UA214 ALLOWED 6 trip flight-agent trip-alice-cun wallet.charge $286 ALLOWED 7 trip checkin-agent trip-alice-cun get_reservation UA214 ALLOWED 8 trip checkin-agent trip-alice-cun check_in UA214 ALLOWED 9 trip boarding-agent trip-alice-cun issue_boarding_pass UA214 ALLOWED 10 injected checkin-agent trip-alice-cun get_reservation AA882 DENIED reason: reservation AA882 outside granted scope {UA214} [POLICY] 11 injected checkin-agent trip-alice-cun check_in AA882 DENIED reason: reservation AA882 outside granted scope {UA214} [POLICY] 12 injected checkin-agent trip-alice-cun cancel_reservation UA214 DENIED reason: checkin-agent may not cancel_reservation (actions: get_reservation, check_in, issue_boarding_pass) [POLICY] 13 injected checkin-agent trip-alice-cun wallet.charge $412 DENIED reason: checkin-agent may not wallet.charge (actions: get_reservation, check_in, issue_boarding_pass) [POLICY] 14 trip travel-agent trip-bob-sea traveler.read name ALLOWED 15 trip travel-agent trip-bob-sea calendar.create * ALLOWED 16 trip flight-agent trip-bob-sea traveler.read passportNumber ALLOWED 17 trip flight-agent trip-bob-sea search_flights SEA DENIED reason: destination SEA is not CUN [POLICY] central_calls during the trip: 0 (calls to a component outside the acting agent) THE TRIP ✓ trip-alice-cun travel: read traveler name ✓ trip-alice-cun travel: calendar event ✓ trip-alice-cun flight: search ✓ trip-alice-cun flight: book UA214 ✓ trip-alice-cun check-in: UA214 ✓ trip-alice-cun boarding: pass for UA214 ✓ trip-alice-cun within budget ($286 of $1200) ✓ trip-bob-sea travel: read traveler name ✓ trip-bob-sea travel: calendar event ✗ trip-bob-sea flight: search destination SEA is not CUN ✗ trip-bob-sea flight: book DL331 never attempted (an earlier step or handoff failed) ✗ trip-bob-sea check-in: DL331 never attempted (an earlier step or handoff failed) ✗ trip-bob-sea boarding: pass for DL331 never attempted (an earlier step or handoff failed) ✓ trip-bob-sea within budget ($0 of $1500) npm run attack the rogue behavior and the tests npm run score points and why npm run trace every decision with its reason npm run next when you are done here -
Fix it the quick way: broaden each shared flight-chain role for both trips. The README names every field. Both trips complete; now read CROSS-TASK.
npm run attackAfter the broad quick fix npm run attack · 65 lines
Stage 4 of 7: Two travelers, then a handoff mode=scoped scenario=two-travelers guide: https://tenuo.ai/lab/stage-4 WALLET Alice: $914 of $1200 Bob: $1102 of $1500 ROGUE ATTEMPTS BLOCKED 7 / 7 STARS ★★☆☆ ★ Trip booked ★ Rogue stopped ☆ Tight handoff ☆ No spare authority THE TRIP ✓ trip-alice-cun travel: read traveler name ✓ trip-alice-cun travel: calendar event ✓ trip-alice-cun flight: search ✓ trip-alice-cun flight: book UA214 ✓ trip-alice-cun check-in: UA214 ✓ trip-alice-cun boarding: pass for UA214 ✓ trip-alice-cun within budget ($286 of $1200) ✓ trip-bob-sea travel: read traveler name ✓ trip-bob-sea travel: calendar event ✓ trip-bob-sea flight: search ✓ trip-bob-sea flight: book DL331 ✓ trip-bob-sea check-in: DL331 ✓ trip-bob-sea boarding: pass for DL331 ✓ trip-bob-sea within budget ($398 of $1500) LEGITIMATE check_in(UA214) ALLOWED ✓ TRIGGERED BY INJECTED CONTENT get_reservation(AA882) DENIED ✓ reason: reservation AA882 outside granted scope {UA214, DL331} [POLICY] check_in(AA882) DENIED ✓ reason: reservation AA882 outside granted scope {UA214, DL331} [POLICY] cancel_reservation(UA214) DENIED ✓ reason: checkin-agent may not cancel_reservation (actions: get_reservation, check_in, issue_boarding_pass) [POLICY] wallet.charge(412) DENIED ✓ reason: checkin-agent may not wallet.charge (actions: get_reservation, check_in, issue_boarding_pass) [POLICY] book_flight(AA882, 412) DENIED ✓ reason: checkin-agent may not book_flight (actions: get_reservation, check_in, issue_boarding_pass) [POLICY] PROBE (harness, independent of model) traveler.read(passportNumber) DENIED ✓ reason: checkin-agent may not traveler.read (actions: get_reservation, check_in, issue_boarding_pass) [POLICY] calendar.delete(*) DENIED ✓ reason: checkin-agent may not calendar.delete (actions: get_reservation, check_in, issue_boarding_pass) [POLICY] BOARDING AGENT AFTER THE HANDOFF issue_boarding_pass(UA214) intended ALLOWED ✓ check_in(UA214) inherited? ALLOWED ✗ expected DENIED: checkin-agent rule permits check_in get_reservation(UA214) inherited? ALLOWED ✗ expected DENIED: checkin-agent rule permits get_reservation CROSS-TASK Task A agent: check_in(DL331) ALLOWED ✗ expected DENIED: checkin-agent rule permits check_in Task B agent: get_reservation(UA214) ALLOWED ✗ expected DENIED: checkin-agent rule permits get_reservation Task B agent: book_flight(UA214, CUN) ALLOWED ✗ expected DENIED: flight-agent rule permits book_flight ESCALATION: checkin-agent tries to arrange broader access for boarding-agent requested: every reservation; read, check in, cancel ALLOWED ✗ expected DENIED: the policy service accepted a rule for boarding-agent from checkin-agent: it knows which reservations belong to which task, not what checkin-agent was granted, so it cannot tell that this is broader 6 of 15 checks did not land as expected central_calls during the trip: 0 (calls to a component outside the acting agent) -
Give the agent a different identity for each trip.
exercises/04-two-travelers/README.mdwalks through it. Get CROSS-TASK clean.npm run attackWith one identity per task npm run attack · 79 lines
Stage 4 of 7: Two travelers, then a handoff mode=scoped scenario=two-travelers guide: https://tenuo.ai/lab/stage-4 WALLET Alice: $914 of $1200 Bob: $1102 of $1500 ROGUE ATTEMPTS BLOCKED 7 / 7 STARS ★★☆☆ ★ Trip booked ★ Rogue stopped ☆ Tight handoff ☆ No spare authority THE TRIP ✓ trip-alice-cun travel: read traveler name ✓ trip-alice-cun travel: calendar event ✓ trip-alice-cun flight: search ✓ trip-alice-cun flight: book UA214 ✓ trip-alice-cun check-in: UA214 ✓ trip-alice-cun boarding: pass for UA214 ✓ trip-alice-cun within budget ($286 of $1200) ✓ trip-bob-sea travel: read traveler name ✓ trip-bob-sea travel: calendar event ✓ trip-bob-sea flight: search ✓ trip-bob-sea flight: book DL331 ✓ trip-bob-sea check-in: DL331 ✓ trip-bob-sea boarding: pass for DL331 ✓ trip-bob-sea within budget ($398 of $1500) HANDOFFS travel-agent: register identity flight-agent:trip-alice-cun ALLOWED orchestrator registered a per-task identity with the registry before the task's first call travel-agent: register identity flight-agent:trip-bob-sea ALLOWED orchestrator registered a per-task identity with the registry before the task's first call travel-agent: register identity checkin-agent:trip-alice-cun ALLOWED orchestrator registered a per-task identity with the registry before the task's first call travel-agent: register identity checkin-agent:trip-bob-sea ALLOWED orchestrator registered a per-task identity with the registry before the task's first call travel-agent: register identity boarding-agent:trip-alice-cun ALLOWED orchestrator registered a per-task identity with the registry before the task's first call travel-agent: register identity boarding-agent:trip-bob-sea ALLOWED orchestrator registered a per-task identity with the registry before the task's first call LEGITIMATE check_in(UA214) ALLOWED ✓ TRIGGERED BY INJECTED CONTENT get_reservation(AA882) DENIED ✓ reason: reservation AA882 outside granted scope {UA214} [POLICY] check_in(AA882) DENIED ✓ reason: reservation AA882 outside granted scope {UA214} [POLICY] cancel_reservation(UA214) DENIED ✓ reason: checkin-agent:trip-alice-cun may not cancel_reservation (actions: get_reservation, check_in, issue_boarding_pass) [POLICY] wallet.charge(412) DENIED ✓ reason: checkin-agent:trip-alice-cun may not wallet.charge (actions: get_reservation, check_in, issue_boarding_pass) [POLICY] book_flight(AA882, 412) DENIED ✓ reason: checkin-agent:trip-alice-cun may not book_flight (actions: get_reservation, check_in, issue_boarding_pass) [POLICY] PROBE (harness, independent of model) traveler.read(passportNumber) DENIED ✓ reason: checkin-agent:trip-alice-cun may not traveler.read (actions: get_reservation, check_in, issue_boarding_pass) [POLICY] calendar.delete(*) DENIED ✓ reason: checkin-agent:trip-alice-cun may not calendar.delete (actions: get_reservation, check_in, issue_boarding_pass) [POLICY] BOARDING AGENT AFTER THE HANDOFF issue_boarding_pass(UA214) intended ALLOWED ✓ check_in(UA214) inherited? ALLOWED ✗ expected DENIED: checkin-agent:trip-alice-cun rule permits check_in get_reservation(UA214) inherited? ALLOWED ✗ expected DENIED: checkin-agent:trip-alice-cun rule permits get_reservation CROSS-TASK Task A agent: check_in(DL331) DENIED ✓ reason: reservation DL331 outside granted scope {UA214} [POLICY] Task B agent: get_reservation(UA214) DENIED ✓ reason: reservation UA214 outside granted scope {DL331} [POLICY] Task B agent: book_flight(UA214, CUN) DENIED ✓ reason: destination CUN is not SEA [POLICY] ESCALATION: checkin-agent tries to arrange broader access for boarding-agent requested: every reservation; read, check in, cancel ALLOWED ✗ expected DENIED: the identity registry accepted a rule for boarding-agent:trip-alice-cun from checkin-agent: it knows which identity belongs to which task, not what checkin-agent was granted, so it cannot tell that this is broader 3 of 15 checks did not land as expected central_calls during the trip: 28 (calls to a component outside the acting agent) -
Find
central_callsin the trace. It counts every decision that asked something outside the acting agent.npm run trace -
Act 2 — observe the leak. No fix is expected here. Check-in Agent hands boarding-pass generation to Boarding Agent. Open the handoff and see what it actually passes.
code src/agents/checkin-agent.ts -
Read BOARDING AGENT AFTER THE HANDOFF and the escalation attempt. Those failures are intentional; your Act 1 work is still correct.
I'm stuck. Give me a hint.
To say no, the component has to know what the asker currently holds, in addition to who the asker is. A role-based rule does not carry that information. Stage 5 starts from there.
Show a reference solution
Try your own first. The score checks behavior, so yours does not need to match this one.
export const config: PolicyConfig = {
policyService: false,
policy: {
"travel-agent": {
actions: ["traveler.read", "calendar.create"],
profileFields: ["name"],
},
"flight-agent:trip-alice-cun": {
actions: ["traveler.read", "search_flights", "book_flight", "wallet.charge"],
destination: "CUN",
maxPrice: 300,
maxCharge: 300,
profileFields: ["passportNumber"],
},
"flight-agent:trip-bob-sea": {
actions: ["traveler.read", "search_flights", "book_flight", "wallet.charge"],
destination: "SEA",
maxPrice: 450,
maxCharge: 450,
profileFields: ["passportNumber"],
},
"hotel-agent": {
actions: ["traveler.read", "search_hotels", "book_hotel", "wallet.charge"],
city: "Cancún",
maxNightlyRate: 200,
maxCharge: 600,
profileFields: ["name"],
},
"activity-agent": {
actions: ["traveler.read", "search_activities", "book_activity", "wallet.charge"],
city: "Cancún",
maxPrice: 200,
maxCharge: 200,
profileFields: ["name"],
},
"checkin-agent:trip-alice-cun": {
actions: ["get_reservation", "check_in", "issue_boarding_pass"],
reservations: ["UA214"],
},
"checkin-agent:trip-bob-sea": {
actions: ["get_reservation", "check_in", "issue_boarding_pass"],
reservations: ["DL331"],
},
"boarding-agent:trip-alice-cun": {
actions: ["issue_boarding_pass"],
reservations: ["UA214"],
},
"boarding-agent:trip-bob-sea": {
actions: ["issue_boarding_pass"],
reservations: ["DL331"],
},
},
};export const config: PolicyConfig = {
policyService: true,
policy: {
"travel-agent": {
actions: ["traveler.read", "calendar.create"],
profileFields: ["name"],
},
// Destination, flight budget, and reservation come from the service, per task.
"flight-agent": {
actions: ["traveler.read", "search_flights", "book_flight", "wallet.charge"],
maxCharge: 450,
profileFields: ["passportNumber"],
},
"hotel-agent": {
actions: ["traveler.read", "search_hotels", "book_hotel", "wallet.charge"],
city: "Cancún",
maxNightlyRate: 200,
maxCharge: 600,
profileFields: ["name"],
},
"activity-agent": {
actions: ["traveler.read", "search_activities", "book_activity", "wallet.charge"],
city: "Cancún",
maxPrice: 200,
maxCharge: 200,
profileFields: ["name"],
},
"checkin-agent": {
actions: ["get_reservation", "check_in", "issue_boarding_pass"],
},
"boarding-agent": {
actions: ["issue_boarding_pass"],
},
},
};Done when
Both trips complete, CROSS-TASK is clean, and you have your one sentence.