Agent inspection API: query a trace without exposing forbidden fields

Scope and references

The records and token-shaped strings are invented. Browser-side controls demonstrate policies but provide no security boundary. A server must enforce its own identity, object and property access rules. The two failure experiments follow OWASP object-level authorization guidance and OWASP property-level authorization guidance. No SDK endpoint or HTTP service is implemented.

Query records, not a scripted response

This experiment evaluates two fictional trace records. Trace 104 belongs to alpha and contains four events: a prompt, a failed tool call, a successful retry and an answer. Trace 205 belongs to beta and contains two events. Tenant and Role describe an already established fixture identity; selecting them is not authentication. Requested trace selects a record or a missing ID. The computed request performs validation, identity checking, object authorization, filtering, pagination and field projection in that order. No real endpoint, credential, model prompt or customer data is read.

Separate object access from field access

Keep tenant alpha, role viewer, trace 104, both safety checks enabled and every requested field selected. Seek to sixty seconds: HTTP 200 returns the first two events with id, kind, status and durationMs. Content and secret are listed as omitted fields. Switch to debugger: content is now included, but secret remains excluded. Role anonymous returns 401 without trace data. These are this fixture's explicit policies, not a universal ADK role definition. Enforce tenant boundary checks the whole object; Enforce field projection checks individual response properties. One cannot replace the other.

Test missing and foreign objects

Select trace 205 while acting as alpha. The response is 404 Trace unavailable, exactly like a missing trace, and contains no event count, owner or content. Disable Enforce tenant boundary to expose beta's record deliberately. The result is labelled unsafe-disclosure even if its fields are projected. Then restore tenant enforcement, select trace 104 and disable Enforce field projection as viewer. Requested content and the obvious FAKE token now appear. This negative branch makes an excessive response visible; it is not a deployable configuration or an actual credential.

Check pagination after filtering

Event status filters the authorized record before Offset and Page size slice it. At defaults, offset zero and size two return a1 and a2 with nextOffset two. Offset two returns a3 and a4 and nextOffset null. Select error, reset offset to zero, and the one matching event is a2; its fixture duration is forty milliseconds. Offset one now returns an empty page while total stays one. Durations are stored fictional data, not browser measurements. Stable offset pagination is appropriate for these immutable arrays; live mutable stores need a defined ordering and snapshot or cursor policy.

Request only the fields you need

The six Requested fields checkboxes choose exact response properties. Clear kind and it disappears even for debugger. Clear every field and events become empty objects while pagination metadata remains. This distinguishes an empty projection from an empty result set. Export response downloads the full computed local result and request, even while playback is paused before its final stage. The audit records a decision and returned count, not prompt text or token values. Nothing in this page claims a real durable audit trail or security isolation: all fixture data is shipped to the browser for teaching.

Inspect at your own pace

Play reveals computed stages across sixty explanatory seconds; Pause holds the current position. Restart rewinds and pauses without changing the request. Next step advances ten inspection seconds and pauses. Timeline scrubs directly and Speed sets half, normal or double pace without affecting query results. Changing request controls starts a new paused inspection. Hidden tabs pause and the page starts paused for reduced motion too. Capture baseline preserves the displayed result and controls; Replace baseline updates it and Clear baseline removes it. Notebook observations persist locally and Export notes downloads them. Expand experiment provides fullscreen inspection. The response and audit are selectable text, usable on phones without a canvas or visual-only status.