Day 54: Specialist Tools per Agent

If every agent shares AdministratorAccess “for convenience,” you do not have roles — you have a distributed root user that can type. Specialist tools mean the Critic cannot shell and the Implementer cannot touch prod IAM.

⚡ TL;DR: Map each role to a tool allowlist and an IAM role. Deny-by-default. Critic = read-only. Implementer = sandbox apply. Planner = search. Prove denies with automated policy tests.

Tool matrices

# config/tool-matrix.yaml
planner:
  tools: [repo_search, list_files, write_plan]
  iam_role: arn:aws:iam::123:role/agent-planner
implementer:
  tools: [apply_intent, run_unit_tests, read_file]
  iam_role: arn:aws:iam::123:role/agent-implementer-sandbox
critic:
  tools: [read_file, read_diff, write_verdict]
  iam_role: arn:aws:iam::123:role/agent-critic-readonly

# gateway/tools.py
MATRIX = {
  "critic": {"read_file", "read_diff", "write_verdict"},
  "implementer": {"apply_intent", "run_unit_tests", "read_file"},
  "planner": {"repo_search", "list_files", "write_plan"},
}

def invoke(role: str, tool: str, args: dict):
    if tool not in MATRIX[role]:
        raise PermissionError(f"denied:{role}:{tool}")  # ✅ hard fail
    return TOOLS[tool](args)

IAM sketches

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CriticReadArtifacts",
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::agent-artifacts/*/diff.json"
    },
    {
      "Sid": "DenyAllShellish",
      "Effect": "Deny",
      "Action": ["ssm:StartSession", "ec2:Create*", "iam:*"],
      "Resource": "*"
    }
  ]
}

❌ Granting Implementer iam:PassRole on prod roles “so it can deploy” — that is how a confused agent becomes a privilege escalator.

Automated deny tests

import pytest
from gateway.tools import invoke

def test_critic_cannot_shell():
    with pytest.raises(PermissionError):
        invoke("critic", "run_shell", {"cmd": "ls"})

Closing checklist

• [ ] Per-role tool allowlists in config + code
• [ ] Per-role IAM roles with explicit denies
• [ ] CI tests that attempt forbidden tools
• [ ] Separate sandbox vs prod credentials
• [ ] Log every deny with run_id

Series navigation

Day 53: Avoiding Agent Ping-Pong · Day 55: Swarm Failure Modes

Last updated September 11, 2026