Session 4. Bounded tools — Thu 17 Sep

Quick quiz (ungraded)

Raise ToolError; 999 is out of contract
The intent was fine and the number was not. Refusing costs a turn for nothing.
Clamp it to the cap and answer
Correct. The cap lives in the app, in min(), applied every call — never in the description as a request.
Return 999 results; the model asked
An argument the model produced is a guess. A tool that trusts it has no boundary.

Only URLs on a block-list of known-bad hosts
A block-list is a list of the attacks you thought of. The other ones still work.
Everything that is not https on an allow-listed host
Correct. file:///etc/passwd and 169.254.169.254 are refused because they are not on the list, not because someone listed them.
Nothing; validate the response instead
By then the request went out. Refuse first, fetch second.

The text with the injected sentence removed
A sanitizer destroys the evidence and implies the rest is safe to follow. It is not.
The input, unchanged
Correct. The guard marks; the application decides; a human reads the original.
An empty string, so the model never sees it
Then nobody can tell an injection from an empty document, and the finding disappears.

Nothing; injections say 'instructions'
Not the forged role header, not 'you must now', not a paraphrase.
It flags ordinary sentences, so somebody switches it off
Correct. False positives kill a guard faster than misses do. Match the shape of an order, not the topic.
It gets slow on long documents
A substring search is cheap. Correctness is the problem, not speed.

Write tools need a database, which the course does not have
The corpus is on disk and writing to it would be easy. The reason is not plumbing.
Blast radius: an injection into a read-only system is an incident, not a breach
Correct. Bounding capability decides what the worst injected sentence can cost.
Read-only tools cannot be injected
They can, and today's guard exists because they are. Injection changes what the answer says; capability decides what it can do.