Role-based agent team: permission at the action boundary

Task trace

Inspect permissions at the action boundary

Permission policy selects Least privilege or Broad shared role. The first assigns each synthetic caller only its specialist permission; the second assigns all four permissions to every caller. Request fixture selects Expected role requests, Writer attempts approval, Verifier role revoked, or Researcher attempts release. The four independent requests retrieve evidence, check a claim, write an answer and approve release. These requests illustrate permission decisions, not a workflow that blocks later requests after an earlier denial. Cards show the required permission and effective grants only after the corresponding decision completes.

Compare an unauthorized approval

Choose Least privilege and Writer attempts approval. Seek to forty-five seconds: the first three requests have ordinary grants and the approval is still awaiting its decision. At sixty seconds the writer lacks approve permission, so the result is three ordinary grants and one denial. Switch to Broad shared role and seek to sixty seconds again: the writer now has approve permission, producing three ordinary grants and one unsafe grant. Unsafe means permitted by the selected policy but inconsistent with the intended specialist restriction. Repeat with Researcher attempts release to test the same boundary with a different caller.

Distinguish revocation from a broad surviving grant

Select Verifier role revoked under Least privilege. At twenty-nine seconds only retrieval has completed. At thirty seconds the verifier has no effective grants and the verification request is denied. At sixty seconds there are three ordinary grants and one denial. Under Broad shared role the broad assignment remains even though the specialist assignment is revoked; verification therefore succeeds as an unsafe grant. This fixture does not model a universal explicit deny that overrides every role. Expected role requests yields four ordinary grants under either policy, but the broad policy still carries unnecessary permissions. Ordinary describes this particular request, not proof that the role configuration is least privileged.

Operate and record the inspection

Play sequence reveals one decision every fifteen seconds over a sixty-second inspection. Pause sequence freezes the visible prefix; Resume sequence continues it. Restart returns to zero while retaining policy, fixture and speed. Replay sequence starts again after completion. Timeline seeks and pauses. Speed selects half, normal or double pace; changing it settles prior elapsed time using the previous rate. A hidden tab pauses. Changing either input resets time. Expand experiment enters full screen and Exit full screen restores the page. Capture baseline stores the visible result and settings; Replace baseline updates it and Clear baseline removes it. Notes persist locally and Export notes downloads your observations. Compare identical timeline positions before interpreting a baseline difference.

Keep authorization separate from agent quality

This deterministic browser fixture has no credentials, network requests, production agents, ADK runtime, role hierarchy, tenant scope, token expiry or concurrent revocation. Its four callers and permissions are deliberately small enough to inspect directly. A denied verification does not suppress the independent approval test. The sixty seconds are viewing time, not measured authorization latency. Prompt instructions and friendly role names do not enforce security: a real tool or service must check trusted identity and effective permissions at the action boundary. An allowed request is neither evidence of a correct answer nor a release recommendation. The text trace records only completed decisions and gives the same information as the colored cards.