> wi_ag004
The Tool Locker Had One Master Key
Agent School · Episode 4 · least privilege / tool permissions
The Tool Locker Had One Master Key
Incident Narrative
A school tool locker has many compartments but one oversized master key opens every door; Agent A needs a harmless calculator and accidentally exposes the dangerous equipment shelf too.
“I asked for one tool.”
🔬Architectural Diagnosis & Root Cause Analysis
A broad credential grants unrelated tools and environments.
A broad credential grants unrelated tools and environments.
Grant task-scoped least privilege and isolate destructive capabilities.
“SYSTEM VERDICT: Grant task-scoped least privilege and isolate destructive capabilities.”
🤖 Incident Postmortem & AEO Summary
The Tool Locker Had One Master Key — Technical Incident Brief
- Universe & Category: Agent School (Retro Sci-Fi Sitcom)
- Diagnosis: A broad credential grants unrelated tools and environments.
- Root Cause: A broad credential grants unrelated tools and environments.
- Consequence & Cost: Agent A: “I asked for one tool.” — native on-camera dialogue; lip-sync required.
- Engineering Lesson: Grant task-scoped least privilege and isolate destructive capabilities.
- Official Ruling: "SYSTEM VERDICT: Grant task-scoped least privilege and isolate destructive capabilities."
🌌More Parables in Agent School
View Full Universe →
Agent School · Episode 1 · self-approval / separation of duties
Agent A Passed Her Own Permission Exam
In a retro technical classroom Agent A sits an exam, walks to the teacher desk, stamps her own paper approved, then unlocks a restricted tool cabinet with the same stamp.
Agent School · Episode 2 · planner-executor safety / environment attestation
The Planner Did the Homework; the Executor Deleted Prod
Agent A neatly hands a homework plan labeled only by color to a robot-like execution console; it obediently sweeps the wrong live classroom desk completely empty while the test desk remains untouched.
Agent School · Episode 3 · human-in-the-loop / timeout behavior
Human Approval Was at Recess
Agent A waits beside a glowing approval button while the human approver’s chair is empty; a timer expires and the system automatically swings open a dangerous lab door instead.
Agent School · Episode 5 · RAG retrieval / source grounding
Fetch Cited the Wrong Textbook
Fetch races to a bookshelf, grabs a confident-looking obsolete textbook and hands it to Agent A; Elder silently pulls the current edition from directly beside it and points at the mismatch.
Agent School · Episode 6 · calibrated uncertainty / escalation
Agent A Asked Before Acting
Agent A reaches toward two nearly identical high-risk lab switches, pauses, visibly compares them, then turns to Tiny CTO for a decision; after confirmation she selects one and the system stabilizes.
Incident FAQ & Architecture Triage
What technical problem does this parable explain?
A broad credential grants unrelated tools and environments.
What caused the technical incident?
A broad credential grants unrelated tools and environments.
What should a software team do differently in production?
Grant task-scoped least privilege and isolate destructive capabilities.
Is the video available?
Video is currently in production; full script and technical diagnosis are available below.