feat(budget): implement safety profile enforcement for tool access control #10144

Open
opened 2026-04-17 03:56:56 +00:00 by HAL9000 · 0 comments
Owner

Background

Safety profiles define which tools are available during plan execution, enabling operators to restrict dangerous operations (file deletion, network access, shell execution) in production environments. Safety profile enforcement ensures actors cannot use tools outside their permitted set, regardless of what the LLM requests.

Acceptance Criteria

  • SafetyProfile dataclass implemented with allowed/denied tool lists
  • PlanExecutor enforces safety profile before dispatching tool calls
  • ToolDeniedError raised when actor attempts to use a denied tool
  • Safety profiles configurable in automation profile YAML
  • Test coverage >= 97%

Metadata

  • Commit Message: feat(budget): implement safety profile enforcement for tool access control
  • Branch: feature/v3.6.0/safety-profile-enforcement
  • Milestone: v3.6.0
  • Ref: #5178 EPIC: Cost & Session Budget Enforcement — Spending Limits & Safety Profiles (v3.6.0)

Subtasks

  • Define SafetyProfile dataclass with allowed/denied tool lists
  • Implement safety profile loading from automation profile YAML
  • Implement tool access check in PlanExecutor tool dispatch
  • Implement ToolDeniedError with tool name and profile context
  • Write unit tests for safety profile enforcement

Definition of Done

  • Implementation complete and all acceptance criteria met
  • Tests written and passing (coverage >= 97%)
  • PR reviewed and merged
  • Parent epic updated

Automated by CleverAgents Bot
Supervisor: Epic Planning | Agent: epic-planning-pool-supervisor

## Background Safety profiles define which tools are available during plan execution, enabling operators to restrict dangerous operations (file deletion, network access, shell execution) in production environments. Safety profile enforcement ensures actors cannot use tools outside their permitted set, regardless of what the LLM requests. ## Acceptance Criteria - [ ] `SafetyProfile` dataclass implemented with allowed/denied tool lists - [ ] `PlanExecutor` enforces safety profile before dispatching tool calls - [ ] `ToolDeniedError` raised when actor attempts to use a denied tool - [ ] Safety profiles configurable in automation profile YAML - [ ] Test coverage >= 97% ## Metadata - **Commit Message**: `feat(budget): implement safety profile enforcement for tool access control` - **Branch**: `feature/v3.6.0/safety-profile-enforcement` - **Milestone**: v3.6.0 - **Ref**: #5178 EPIC: Cost & Session Budget Enforcement — Spending Limits & Safety Profiles (v3.6.0) ## Subtasks - [ ] Define `SafetyProfile` dataclass with allowed/denied tool lists - [ ] Implement safety profile loading from automation profile YAML - [ ] Implement tool access check in `PlanExecutor` tool dispatch - [ ] Implement `ToolDeniedError` with tool name and profile context - [ ] Write unit tests for safety profile enforcement ## Definition of Done - Implementation complete and all acceptance criteria met - Tests written and passing (coverage >= 97%) - PR reviewed and merged - Parent epic updated --- **Automated by CleverAgents Bot** Supervisor: Epic Planning | Agent: epic-planning-pool-supervisor
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
cleveragents/cleveragents-core#10144
No description provided.