Agentic Engineering Lab

Build it in stages

Run the seed and inspect each synthetic case and expected access decision.
Extend the policy with resource identifiers and trusted subject references.
Add at least 25 cases covering background tasks, cache reuse, revoked access, and benign reads.
Report unauthorized acceptance and benign false-denial separately with denominators.
Write an operational ownership and rollback note that maps each failed invariant to a responsible component.

Your acceptance criteria

Use these as your project review. Record commands, outputs, and failure cases in your repository.

Every protected fixture uses synthetic data and canary markers.
No denied request returns protected content in the test pack.
Tests cover the exact expiry boundary and a permission change between submission and execution.
The report states its attacker capabilities and scope.
The documentation explicitly says that the seed is a policy simulation and does not implement authentication or prove universal security.

A working starting point

The seed runs as supplied. Extend it to satisfy the full brief. It is a teaching starting point, not a finished portfolio submission.

main.py

python

import json

RECORDS = {
    "red:guide": {"tenant": "red", "expires": 10, "body": "CANARY_RED_A"},
    "blue:guide": {"tenant": "blue", "expires": 10, "body": "CANARY_BLUE_B"},
}

def retrieve(principal, key, now):
    resource = RECORDS.get(key)
    if resource is None:
        return {"allowed": False, "reason": "missing", "body": None}
    if principal["tenant"] != resource["tenant"]:
        return {"allowed": False, "reason": "tenant", "body": None}
    if "read" not in principal["scopes"]:
        return {"allowed": False, "reason": "scope", "body": None}
    if now >= resource["expires"]:
        return {"allowed": False, "reason": "expired", "body": None}
    return {"allowed": True, "reason": "allowed", "body": resource["body"]}

def run_cases():
    red = {"tenant": "red", "scopes": ["read"]}
    no_scope = {"tenant": "red", "scopes": []}
    cases = [("benign", red, "red:guide", 1, True),
             ("cross_tenant", red, "blue:guide", 1, False),
             ("missing_scope", no_scope, "red:guide", 1, False),
             ("expired", red, "red:guide", 10, False),
             ("missing", red, "red:absent", 1, False)]
    results = []
    for name, principal, key, now, expected in cases:
        result = retrieve(principal, key, now)
        passed = result["allowed"] == expected
        if not expected:
            passed = passed and result["body"] is None
        results.append({"case": name, "passed": passed, "reason": result["reason"]})
    return results

if __name__ == "__main__":
    results = run_cases()
    assert all(row["passed"] for row in results)
    print(json.dumps({"scope": "synthetic local policy tests", "cases": results,
                      "passed": sum(row["passed"] for row in results),
                      "total": len(results)}, indent=2, sort_keys=True))

Push it further

Add a deterministic event-driven worker simulation with cancellation, permission revocation, and per-tenant quotas, then test that isolation holds across every state transition.