← All workshopsRead Whose Pump Is Botie Allowed to Inspect?

Agents

Check the caller against the stored asset

BOTIE

Compare the authenticated principal’s tenant with the stored asset’s tenant before considering its short ID.
Ready to test
0 passed · 0 failed · 2 not run

An empty floor. Start with the information your machine needs.

Received result

Your answer will arrive here.

Examples, experiments and workspace controls
Live values

Connect a tool's inputs to see what it produces. You can try a branch before connecting it to Result.

Try your own inputs

Use a copy of the example to try your own data. Keep the problem's assumptions in mind, and predict the effect of a change before checking the output. You can also add another branch to compare two ways of doing the calculation.

Start at an output arrow, then click or drag to an input. Drag empty space to pan. Delete removes a selection. Ctrl/Cmd+Z undoes a change.
Context for this challenge

Compare the authenticated principal’s tenant with the stored asset’s tenant before considering its short ID.

An allowed read tool can still name an asset outside the caller’s tenant or assignment.

Inspect the component calculation
Match the tenant(
  Server-authenticated principal: Server-authenticated principal
  Stored asset record: Stored asset record
)
Examples and results
Server-authenticated principal
{
  "tenant": "north",
  "assets": [
    "P7"
  ],
  "operations": [
    "read"
  ]
}
Stored asset record
{
  "tenant": "north",
  "id": "P7"
}
Required result
true
Server-authenticated principal
{
  "tenant": "north",
  "assets": [
    "P7"
  ],
  "operations": [
    "read"
  ]
}
Stored asset record
{
  "tenant": "north",
  "id": "P7"
}
Required result
true
Try a fresh construction

This clears this draft, including its undo history. Earlier successful attempts stay recorded. Build again without opening hints to record an independent attempt.

Stuck? Inspect a worked construction

The tools below form one possible solution. You can assemble it, follow its signals, and undo that change to return to your own construction.

Assumptions and test precision

The browser fixtures illustrate policy evaluation; they provide no authentication, database transaction, token verification or production permission service. Numerical tests allow a difference of 0.001. Lists and structures must also have the right shape.

Your last tested pieces can start the full construction. An existing draft there keeps its own pieces.

The asset is in the right tenant but outside the assignment

This check uses the pieces from “Authorise this operation on this asset”.

BOTIE

The caller belongs to north and can read P2 and P4. The stored P9 also belongs to north. Predict whether this read is allowed without widening the caller’s assignment.
Server-authenticated principal
{
  "tenant": "north",
  "assets": [
    "P2",
    "P4"
  ],
  "operations": [
    "read"
  ]
}
Stored asset record
{
  "tenant": "north",
  "id": "P9"
}
Requested operation
read

Use a number, text, or an array matching the requested result. For a matrix, put each row in brackets. Saving your prediction runs your current construction on these inputs and checks the earlier examples too.

Build a construction in the workspace above first. This case will test those pieces.

Where would you enforce this policy if somebody called the service directly without using Botie’s interface?

Keep the check beside the protected operation and use the object actually loaded by the service.

The browser fixtures illustrate policy evaluation; they provide no authentication, database transaction, token verification or production permission service.

Work through the Python challenges →
Continue the courseHow Much of the Maintenance Record Does Botie Need? →
← What If the Manual Starts Giving Botie Orders?