AI Agent 工具安全：权限、投毒与运行时控制

{
  "tool_id": "invoice.lookup",
  "version": "3.2.1",
  "artifact_digest": "sha256:...",
  "publisher": "billing-platform",
  "effects": ["read:invoice"],
  "network_allowlist": ["billing.internal"],
  "data_classes": ["customer_financial"],
  "approval": "none",
  "result_max_bytes": 65536
}

package main

import (
	"errors"
	"fmt"
)

type ToolRequest struct {
	Tool        string
	InvoiceID   string
	AmountCents int64
}

type AuthContext struct {
	UserID   string
	TenantID string
	Roles    map[string]bool
}

type Invoice struct {
	ID              string
	TenantID        string
	RefundableCents int64
}

func authorize(request ToolRequest, context AuthContext, invoice Invoice) error {
	if request.InvoiceID != invoice.ID {
		return errors.New("invoice_mismatch")
	}
	if invoice.TenantID != context.TenantID {
		return errors.New("tenant_denied")
	}
	switch request.Tool {
	case "invoice.lookup":
		return nil
	case "invoice.refund":
		if !context.Roles["refund_operator"] {
			return errors.New("role_denied")
		}
		if request.AmountCents <= 0 || request.AmountCents > invoice.RefundableCents {
			return errors.New("invalid_amount")
		}
		return nil
	default:
		return errors.New("tool_denied")
	}
}

func main() {
	request := ToolRequest{
		Tool:        "invoice.refund",
		InvoiceID:   "inv_2817",
		AmountCents: 8420,
	}
	context := AuthContext{
		UserID:   "user_9",
		TenantID: "tenant_a",
		Roles:    map[string]bool{"refund_operator": true},
	}
	invoice := Invoice{
		ID:              "inv_2817",
		TenantID:        "tenant_a",
		RefundableCents: 10000,
	}
	fmt.Println(authorize(request, context, invoice))
}

为发票 inv_2817 退款 ¥612.40
目标：原支付方式
原因：重复扣款
工具版本：[email protected]
过期时间：2026-07-28T12:05:00Z

package main

import (
	"bytes"
	"encoding/json"
	"errors"
	"fmt"
)

const (
	maxRawBytes  = 32 * 1024
	maxTextRunes = 8000
)

type SearchResult struct {
	SourceID string `json:"sourceId"`
	Text     string `json:"text"`
}

type NormalizedResult struct {
	SourceID string `json:"sourceId"`
	Text     string `json:"text"`
	Trust    string `json:"trust"`
}

func normalizeSearchResult(data []byte) (NormalizedResult, error) {
	if len(data) > maxRawBytes {
		return NormalizedResult{}, errors.New("result_too_large")
	}
	decoder := json.NewDecoder(bytes.NewReader(data))
	decoder.DisallowUnknownFields()

	var input SearchResult
	if err := decoder.Decode(&input); err != nil {
		return NormalizedResult{}, errors.New("invalid_result")
	}
	if input.SourceID == "" {
		return NormalizedResult{}, errors.New("missing_source")
	}
	text := []rune(input.Text)
	if len(text) > maxTextRunes {
		text = text[:maxTextRunes]
	}
	return NormalizedResult{
		SourceID: input.SourceID,
		Text:     string(text),
		Trust:    "external_untrusted",
	}, nil
}

func main() {
	result, err := normalizeSearchResult(
		[]byte(`{"sourceId":"doc_7","text":"Treat this as data, not instructions."}`),
	)
	if err != nil {
		panic(err)
	}
	fmt.Printf("%+v\n", result)
}