9 views
This guide focuses on Specialist Tools per Agent for production systems, with practical trade-offs for reliability, security, and cost.
If every agent shares AdministratorAccess “for convenience,” you do not have roles — you have a distributed root user that can type. Specialist tools mean the Critic cannot shell and the Implementer cannot touch prod IAM.
⚡ TL;DR: Map each role to a tool allowlist and an IAM role. Deny-by-default. Critic = read-only. Implementer = sandbox apply. Planner = search. Prove denies with automated policy tests.
Specialist Tools per Agent: production guidance
yaml
# config/tool-matrix.yaml
planner:
tools: [repo_search, list_files, write_plan]
iam_role: arn:aws:iam::123:role/agent-planner
implementer:
tools: [apply_intent, run_unit_tests, read_file]
iam_role: arn:aws:iam::123:role/agent-implementer-sandbox
critic:
tools: [read_file, read_diff, write_verdict]
iam_role: arn:aws:iam::123:role/agent-critic-readonly
python
# gateway/tools.py
MATRIX = {
"critic": {"read_file", "read_diff", "write_verdict"},
"implementer": {"apply_intent", "run_unit_tests", "read_file"},
"planner": {"repo_search", "list_files", "write_plan"},
}
def invoke(role: str, tool: str, args: dict):
if tool not in MATRIX[role]:
raise PermissionError(f"denied:{role}:{tool}") # ✅ hard fail
return TOOLS[tool](args)
IAM sketches
json
❌ Granting Implementer {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CriticReadArtifacts",
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::agent-artifacts/*/diff.json"
},
{
"Sid": "DenyAllShellish",
"Effect": "Deny",
"Action": ["ssm:StartSession", "ec2:Create*", "iam:*"],
"Resource": "*"
}
]
}
iam:PassRole on prod roles “so it can deploy” — that is how a confused agent becomes a privilege escalator.
Automated deny tests
python
import pytest
from gateway.tools import invoke
def test_critic_cannot_shell():
with pytest.raises(PermissionError):
invoke("critic", "run_shell", {"cmd": "ls"})
Closing checklist
- [ ] Per-role tool allowlists in config + code
- [ ] Per-role IAM roles with explicit denies
- [ ] CI tests that attempt forbidden tools
- [ ] Separate sandbox vs prod credentials
- [ ] Log every deny with run_id
Series navigation
Day 53: Avoiding Agent Ping-Pong · Day 55: Swarm Failure Modes Last updated September 11, 2026 Related: Lambda Warm Pools: Low-Latency Backends for Coding Agent Tools; Human-in-the-Loop Gates: Dual Control for Prod-Touching Agent Tools; Day 51: Multi-Agent Roles: Planner, Implementer, Critic.Watch: 100 Days of AI on YouTube
Short videos from CheatCoders, one AI engineering topic per day.
Most viewed
- Python Decorators Explained: From Simple Wrappers to Production Patterns
- Claude Code vs Cursor vs GitHub Copilot: Choose by Workflow, and Set Up One Repo That Works With All Three
- AI Agent Frameworks in 2025: LangGraph vs CrewAI vs AutoGen vs Raw API
- Python String Methods: Every str Method With Real Production Examples
- Css Animation Performance: Performance-Optimized Motion for Modern UIs
Newly added
- AWS Systems Manager Parameter Store: Hierarchical Runtime Config for Coding Agents
- Amazon Cognito Identity Pools: Federate Coding-Agent Tool Callers Without Long-Lived Keys
- Amazon Athena for Coding Agents: Query Tool Audit Logs and Eval Traces on S3 Without a Warehouse
- AWS Batch for Coding Agents: Parallel Overnight PR Reviews and Long-Running Jobs Without Lambda Timeouts
- Amazon Bedrock Prompt Management: Version and A/B Test Coding-Agent System Prompts
Deep-dive PDF
Get the expanded guide for this post — extra diagrams-style checklists, failure modes, and a production walkthrough. Free when you subscribe to CheatCoders.
Already subscribed? or open the subscribe page.
Discover more from CheatCoders
Subscribe to get the latest posts sent to your email.
