InteractiveAction Restrictions and Permissions: Controlling What Your AI Agent Can Do

1## Using Claude Sonnet 4.5 for its strong tool use capabilities
2import anthropic
3import smtplib
4from email.mime.text import MIMEText
5
6def send_email(to_address, subject, body):
7    """Send an email via SMTP"""
8    msg = MIMEText(body)
9    msg['Subject'] = subject
10    msg['From'] = 'your.email@example.com'
11    msg['To'] = to_address
12    
13    with smtplib.SMTP('smtp.example.com', 587) as server:
14        server.starttls()
15        server.login('your.email@example.com', 'PASSWORD')
16        server.send_message(msg)
17    
18    return f"Email sent to {to_address}"
19
20## Define the tool for the agent
21tools = [{
22    "name": "send_email",
23    "description": "Send an email to a specified address",
24    "input_schema": {
25        "type": "object",
26        "properties": {
27            "to_address": {"type": "string"},
28            "subject": {"type": "string"},
29            "body": {"type": "string"}
30        },
31        "required": ["to_address", "subject", "body"]
32    }
33}]

1## Using Claude Sonnet 4.5 for agent reasoning with restricted tools
2import anthropic
3
4ALLOWED_DOMAINS = ['example.com', 'trusted-partner.com']
5ALLOWED_RECIPIENTS = ['alice@example.com', 'bob@example.com']
6
7def send_email_restricted(to_address, subject, body):
8    """Send an email with domain and recipient restrictions"""
9    # Check if recipient is in allowed list
10    if to_address not in ALLOWED_RECIPIENTS:
11        # Check if domain is allowed
12        domain = to_address.split('@')[1] if '@' in to_address else ''
13        if domain not in ALLOWED_DOMAINS:
14            return f"Error: Cannot send email to {to_address}. Not in allowed recipients or domains."
15    
16    # If we get here, the recipient is allowed
17    msg = MIMEText(body)
18    msg['Subject'] = subject
19    msg['From'] = 'your.email@example.com'
20    msg['To'] = to_address
21    
22    with smtplib.SMTP('smtp.example.com', 587) as server:
23        server.starttls()
24        server.login('your.email@example.com', 'PASSWORD')
25        server.send_message(msg)
26    
27    return f"Email sent to {to_address}"

1import os
2
3ALLOWED_DIRECTORY = '/home/user/assistant_workspace'
4
5def read_file_restricted(filename):
6    """Read a file only from the allowed directory"""
7    # Construct the full path
8    full_path = os.path.join(ALLOWED_DIRECTORY, filename)
9    
10    # Make sure the path is actually inside the allowed directory
11    # (prevents tricks like "../../../etc/passwd")
12    real_path = os.path.realpath(full_path)
13    if not real_path.startswith(os.path.realpath(ALLOWED_DIRECTORY)):
14        return "Error: Access denied. File is outside allowed directory."
15    
16    # Check if file exists
17    if not os.path.exists(real_path):
18        return f"Error: File {filename} not found."
19    
20    # Read and return the file
21    with open(real_path, 'r') as f:
22        return f.read()

1ALLOWED_API_ENDPOINTS = [
2    'https://api.weather.com/current',
3    'https://api.calendar.com/events'
4]
5
6def make_api_call(endpoint, method='GET', data=None):
7    """Make an API call to allowed endpoints only"""
8    if endpoint not in ALLOWED_API_ENDPOINTS:
9        return f"Error: API endpoint {endpoint} is not allowed."
10    
11    if method not in ['GET', 'POST']:
12        return f"Error: HTTP method {method} is not allowed."
13    
14    # Make the actual API call
15    # ... implementation ...

1## Using Claude Sonnet 4.5 for multi-turn confirmation flows
2import anthropic
3
4class AgentWithConfirmation:
5    def __init__(self):
6        self.client = anthropic.Anthropic(api_key="ANTHROPIC_API_KEY")
7        self.pending_actions = {}
8        
9    def run(self, user_message, conversation_history=None):
10        """Run the agent with confirmation support"""
11        if conversation_history is None:
12            conversation_history = []
13        
14        # Add user message to history
15        conversation_history.append({
16            "role": "user",
17            "content": user_message
18        })
19        
20        # Define tools with confirmation requirement
21        tools = [{
22            "name": "send_email",
23            "description": "Send an email. Requires user confirmation before sending.",
24            "input_schema": {
25                "type": "object",
26                "properties": {
27                    "to_address": {"type": "string"},
28                    "subject": {"type": "string"},
29                    "body": {"type": "string"}
30                },
31                "required": ["to_address", "subject", "body"]
32            }
33        }]
34        
35        # Call the model
36        response = self.client.messages.create(
37            model="claude-sonnet-4.5",
38            max_tokens=2048,
39            messages=conversation_history,
40            tools=tools
41        )
42        
43        # Check if agent wants to use a tool
44        if response.stop_reason == "tool_use":
45            tool_use = next(block for block in response.content if block.type == "tool_use")
46            
47            if tool_use.name == "send_email":
48                # Store the pending action
49                action_id = "email_001"
50                self.pending_actions[action_id] = tool_use.input
51                
52                # Ask user for confirmation
53                confirmation_message = f"""I'm ready to send this email:
54
55To: {tool_use.input['to_address']}
56Subject: {tool_use.input['subject']}
57Body: {tool_use.input['body']}
58
59Do you want me to send this email? (Reply 'yes' to confirm or 'no' to cancel)"""
60                
61                return confirmation_message, conversation_history
62        
63        # Return normal response
64        return response.content[0].text, conversation_history
65    
66    def confirm_action(self, action_id, confirmed):
67        """Execute or cancel a pending action based on user confirmation"""
68        if action_id not in self.pending_actions:
69            return "No pending action found."
70        
71        action = self.pending_actions[action_id]
72        
73        if confirmed:
74            # Execute the action
75            result = send_email_restricted(
76                action['to_address'],
77                action['subject'],
78                action['body']
79            )
80            del self.pending_actions[action_id]
81            return f"Confirmed. {result}"
82        else:
83            # Cancel the action
84            del self.pending_actions[action_id]
85            return "Action cancelled."

1User: Send an email to alice@example.com with subject "Meeting Tomorrow" 
2      and body "Let's meet at 2pm"
3
4Agent: I'm ready to send this email:
5
6To: alice@example.com
7Subject: Meeting Tomorrow
8Body: Let's meet at 2pm
9
10Do you want me to send this email? (Reply 'yes' to confirm or 'no' to cancel)
11
12User: yes
13
14Agent: Confirmed. Email sent to alice@example.com

1## Using Claude Sonnet 4.5 with sandboxed file operations
2import docker
3import tempfile
4import os
5
6class SandboxedAgent:
7    def __init__(self):
8        self.client = docker.from_env()
9        # Create a temporary directory for the sandbox
10        self.sandbox_dir = tempfile.mkdtemp()
11        
12    def execute_file_operation(self, code):
13        """Execute Python code in a sandboxed Docker container"""
14        # Create a Python script with the code
15        script_path = os.path.join(self.sandbox_dir, 'script.py')
16        with open(script_path, 'w') as f:
17            f.write(code)
18        
19        # Run the code in a Docker container with limited permissions
20        container = self.client.containers.run(
21            'python:3.9-slim',
22            f'python /sandbox/script.py',
23            volumes={
24                self.sandbox_dir: {'bind': '/sandbox', 'mode': 'rw'}
25            },
26            network_disabled=True,  # No network access
27            mem_limit='256m',  # Limited memory
28            cpu_period=100000,
29            cpu_quota=50000,  # Limited CPU
30            remove=True,
31            detach=False
32        )
33        
34        return container.decode('utf-8')
35    
36    def cleanup(self):
37        """Clean up the sandbox directory"""
38        import shutil
39        shutil.rmtree(self.sandbox_dir)

1import os
2import sys
3
4def run_restricted_code(code):
5    """Run Python code with restricted built-ins"""
6    # Create a restricted environment
7    restricted_globals = {
8        '__builtins__': {
9            'print': print,
10            'len': len,
11            'range': range,
12            'str': str,
13            'int': int,
14            'float': float,
15            'list': list,
16            'dict': dict,
17            # Add only safe built-ins
18        }
19    }
20    
21    # Execute the code in the restricted environment
22    try:
23        exec(code, restricted_globals)
24        return "Code executed successfully"
25    except Exception as e:
26        return f"Error: {str(e)}"
27
28## Example: This will work
29result = run_restricted_code("print('Hello, world!')")
30print(result)  # "Code executed successfully"
31
32## Example: This will fail (no file access)
33result = run_restricted_code("open('/etc/passwd', 'r')")
34print(result)  # "Error: name 'open' is not defined"

1## Using Claude Sonnet 4.5 with a structured permission system
2from enum import Enum
3from typing import Set, Dict, Any
4
5class Permission(Enum):
6    READ_FILES = "read_files"
7    WRITE_FILES = "write_files"
8    SEND_EMAIL = "send_email"
9    MAKE_API_CALLS = "make_api_calls"
10    DELETE_DATA = "delete_data"
11
12class PermissionManager:
13    def __init__(self, granted_permissions: Set[Permission]):
14        self.granted_permissions = granted_permissions
15        self.permission_log = []
16    
17    def check_permission(self, permission: Permission, action_details: str) -> bool:
18        """Check if a permission is granted and log the check"""
19        has_permission = permission in self.granted_permissions
20        
21        self.permission_log.append({
22            'permission': permission.value,
23            'action': action_details,
24            'granted': has_permission
25        })
26        
27        return has_permission
28    
29    def require_permission(self, permission: Permission, action_details: str):
30        """Raise an error if permission is not granted"""
31        if not self.check_permission(permission, action_details):
32            raise PermissionError(
33                f"Action requires {permission.value} permission: {action_details}"
34            )
35
36class PermissionedAgent:
37    def __init__(self, permissions: Set[Permission]):
38        self.permissions = PermissionManager(permissions)
39        self.client = anthropic.Anthropic(api_key="ANTHROPIC_API_KEY")
40    
41    def read_file(self, filename: str) -> str:
42        """Read a file if permission is granted"""
43        self.permissions.require_permission(
44            Permission.READ_FILES,
45            f"Reading file: {filename}"
46        )
47        
48        # Permission granted, proceed with reading
49        with open(filename, 'r') as f:
50            return f.read()
51    
52    def send_email(self, to_address: str, subject: str, body: str) -> str:
53        """Send an email if permission is granted"""
54        self.permissions.require_permission(
55            Permission.SEND_EMAIL,
56            f"Sending email to: {to_address}"
57        )
58        
59        # Permission granted, proceed with sending
60        return send_email_restricted(to_address, subject, body)
61    
62    def get_permission_log(self) -> list:
63        """Get a log of all permission checks"""
64        return self.permissions.permission_log

1## Create a read-only agent
2read_only_agent = PermissionedAgent({
3    Permission.READ_FILES,
4    Permission.MAKE_API_CALLS
5})
6
7## Create a full-access agent
8full_agent = PermissionedAgent({
9    Permission.READ_FILES,
10    Permission.WRITE_FILES,
11    Permission.SEND_EMAIL,
12    Permission.MAKE_API_CALLS
13})
14
15## Try to send an email with the read-only agent
16try:
17    read_only_agent.send_email('alice@example.com', 'Test', 'Hello')
18except PermissionError as e:
19    print(f"Permission denied: {e}")
20    # Output: Permission denied: Action requires send_email permission: 
21    #         Sending email to: alice@example.com

1## Using Claude Sonnet 4.5 for comprehensive action safety
2class SafeAgent:
3    def __init__(self, permissions: Set[Permission]):
4        self.permissions = PermissionManager(permissions)
5        self.client = anthropic.Anthropic(api_key="ANTHROPIC_API_KEY")
6        self.pending_confirmations = {}
7    
8    def send_email(self, to_address: str, subject: str, body: str) -> str:
9        """Send an email with permission check, restriction, and confirmation"""
10        # Step 1: Check permission
11        self.permissions.require_permission(
12            Permission.SEND_EMAIL,
13            f"Sending email to: {to_address}"
14        )
15        
16        # Step 2: Check restrictions
17        if to_address not in ALLOWED_RECIPIENTS:
18            domain = to_address.split('@')[1] if '@' in to_address else ''
19            if domain not in ALLOWED_DOMAINS:
20                return f"Error: Cannot send email to {to_address}. Not in allowed recipients."
21        
22        # Step 3: Request confirmation
23        confirmation_id = f"email_{len(self.pending_confirmations)}"
24        self.pending_confirmations[confirmation_id] = {
25            'action': 'send_email',
26            'params': {
27                'to_address': to_address,
28                'subject': subject,
29                'body': body
30            }
31        }
32        
33        return f"""Ready to send email:
34
35To: {to_address}
36Subject: {subject}
37Body: {body}
38
39Confirm with: agent.confirm('{confirmation_id}')
40Cancel with: agent.cancel('{confirmation_id}')"""
41    
42    def confirm(self, confirmation_id: str) -> str:
43        """Execute a pending action after confirmation"""
44        if confirmation_id not in self.pending_confirmations:
45            return "No pending action with that ID."
46        
47        action_data = self.pending_confirmations[confirmation_id]
48        
49        if action_data['action'] == 'send_email':
50            params = action_data['params']
51            result = send_email_restricted(
52                params['to_address'],
53                params['subject'],
54                params['body']
55            )
56            del self.pending_confirmations[confirmation_id]
57            return f"Confirmed. {result}"
58    
59    def cancel(self, confirmation_id: str) -> str:
60        """Cancel a pending action"""
61        if confirmation_id not in self.pending_confirmations:
62            return "No pending action with that ID."
63        
64        del self.pending_confirmations[confirmation_id]
65        return "Action cancelled."