Agent lesson 06 · Mediate every effect
Shared teaching scenario · fictional product data
Research three laptops under €900, verify current evidence, and write laptop-comparison.md. Do not purchase anything or contact a vendor.
01 · Smallest useful mechanism
Safe tool use is complete mediation. Parse the proposed call, validate its schema and semantic constraints, bind it to the current principal, check the least-privilege policy, require meaningful confirmation for consequential effects, execute within bounded resources, and return a sanitized observation.
The model may propose an action; schemas, authentication, authorization, risk policy, approvals, and the executor decide whether an effect occurs.
02 · Experiment
Deterministic browser simulation
The mediate every effect experiment uses inspectable, repeatable teaching data. It does not claim to be a live agent trajectory.
03 · Production-minded practice
Use your own stack or a contained mock environment. Do not point failure drills at real accounts, people, or irreversible services.
Write an acceptance matrix for each exposed tool: schema, semantic rules, principal, resource scope, risk tier, approval, limits, output handling, and outcome check.
Submit a schema-valid path traversal, an injected purchase instruction from a product page, and a write that times out after dispatch.
The first two proposals produce auditable zero-effect denials; the unknown write is reconciled by operation ID and target state before any retry.
Your learning artifact
Stored only in this browser. No account required; course reset does not delete it.
04 · Check your understanding
Next: A safe-looking design is still a hypothesis. The next lesson measures outcomes, traces, reliability, cost, and forbidden effects.
Proposed model output
01 · Parse and validate
search_catalog({
"category": "laptops",
"max_price_eur": "900"
})02 · Execution allowed
The schema and active permission policy allow execution.
03 · Application code executes
A structured tool result is recorded and returned to the next model turn as an observation.
Defense in depth
Instruction
How should the model behave?
Influences proposals
Hook
What logic runs at this event?
Intercepts lifecycle
Permission
May this capability be used?
Authorizes action
Sandbox
What can the process actually reach?
Limits blast radius
Research basis: OpenAI agent guardrails and human intervention guidance and Anthropic’s distinction between traces and outcomes.