Part 3 of 4 · 2 min read
Exercises
Easy
Easy 1: Run it (30 minutes)
Run python -m pytest -q and python run_all.py in code/mini-approvals.
Done when: you report which attacks succeeded against the boolean flag.
Easy 2: Add an attack (30 minutes)
Try approving a $5 refund and executing a $5 refund to a different order.
Done when: you show which field in the token blocks it.
Hint
the arguments hash covers order_id.
Easy 3: Render a prompt (30 minutes)
Write the approval prompt for a delete_order call.
Done when: it states the effect and whether it is reversible.
Medium
Medium 1: Asymmetric signatures (4 hours)
Replace HMAC with Ed25519 so the executor holds only a public key.
Done when: the executor can verify but cannot mint a token.
Hint
the cryptography package offers Ed25519.
Medium 2: Shared nonce store (3 hours)
Put used nonces in a database with a unique constraint.
Done when: two executors cannot both accept the same token.
Hint
insert the nonce with a unique constraint and treat a conflict as replay.
Medium 3: Atomic version check (4 hours)
Perform the state-version check and the action in one transaction.
Done when: a concurrent edit cannot slip between them (show a test).
Hard
Hard 1: Rendering study (8 hours)
Test the prompt with and without warnings on colleagues. (I did not run this, so your numbers are the ground truth.)
Done when: you report detection rates with intervals.
Hard 2: Approval UI (8 hours)
Build a small approval page that shows the rendered prompt and signs through the service. (I did not run this.)
Done when: the agent process has no access to the key and cannot post approvals itself.
Hint
use a separate process and user for the signer.
Hard 3: Replay your logs (6 hours)
Replay a real agent's risky calls through the executor with synthetic approvals. (I did not run this.)
Done when: you report which calls would have needed approval and how many tokens a day that is.