Agentic AI
Security.

class HardenedToolDispatcher:
    def __init__(self, iam_client, policy_engine):
        self.iam = iam_client
        self.policy = policy_engine

    def dispatch(self, agent_id: str, tool: str, args: dict, user_jwt: str):
        # 1. Enforce user RBAC delegation on every tool call
        user_context = self.iam.validate_delegation(user_jwt, agent_id)
        if not user_context.can_execute(tool):
            raise UnauthorizedActionError(f"User {user_context.uid} lacks privilege for {tool}")

        # 2. Enforce deterministic Human-in-the-Loop on high-impact tools
        if self.policy.is_high_impact(tool):
            mfa_token = args.get("mfa_confirmation_token")
            if not self.iam.verify_mfa_token(mfa_token, user_context.uid):
                raise ApprovalRequiredError(f"Tool {tool} requires out-of-band user MFA signature.")

        # 3. Sanitize parameters against rigid JSON schema
        clean_args = self.policy.validate_schema(tool, args)
        return self._execute_sandboxed(tool, clean_args)