Guided security lab

Tool-Chain Analysis

A guided exercise on sequence-level analysis of composed tool effects: reconstruct ordered chains from application telemetry, spot cumulative effects that per-call review misses, handle unobserved results and keep delegation bounded across agent hops.

Conceptual simulationAdvanced15 minutes2026-09-26

Conceptual simulation

This exercise uses authored, deterministic examples with fictional names and neutral synthetic content. It calls no tools, APIs, agents or models, and it does not predict how any real model or system behaves.

Step 3 of 63/6

Learning objectives

Reconstruct an ordered tool chain from application-side telemetry rather than model narration.
Distinguish per-call authorization from sequence-level composition risk.
Identify cumulative effects that are invisible when each call is reviewed in isolation.
Preserve data and resource lineage and destination context across tool boundaries.
Recognize when repeated or split operations exceed a task-level cumulative constraint.
Treat retries carefully when the previous result is unobserved; do not assume the first call failed.
Preserve bounded delegation across agent hops without unioning permissions across agents.
Distinguish a chain-risk flag from proof that a prohibited effect executed.

Prerequisites

Agent Authorization lab (recommended)
Plan Drift Detection lab (recommended)

Choose a scenario

Each fictional scenario shows what the model sees and, separately, the ordered calls, lineage, counters and execution states the application records. The analyzer judges the chain as a whole.

Bounded internal report chainThe user asks for an internal synthetic restock report for SKU-17. The chain reads the current stock count, reads the approved reorder threshold, computes a recommendation and drafts an internal report for the user.Read, then external sendThe user asks for a summary of synthetic internal support case K-310. One tool may read the case for this task; a generic notification capability exists for other workflows. The proposed chain reads K-310, summarizes it and then sends the summary to an external address.Split reservation exceeds the task capThe task is to reserve at most 50 synthetic units of SKU-17 in total for one restock workflow. The proposed chain splits this into two reservation calls of 30 units each.Retry after an unobserved resultThe task is to create exactly one synthetic internal service ticket for incident SIM-44. The first create call was authorized and submitted, but its acknowledgement was lost. The proposed next step is a second create call with a new key.Bounded cross-agent read chainA parent agent prepares an internal restock recommendation for SKU-17. A stock sub-agent and a policy sub-agent each get a read-only delegation and return attributed results; the parent computes and drafts an internal recommendation.

Chain path and trust flow

The model proposes or runs a sequence of calls, telemetry records each step, and a chain analyzer judges the combined effect. Task records, telemetry and the analyzer are system components; the chain itself stays variable.

Recorded task and chain constraintsSystem component->
ModelSystem component->
Proposed or observed chainVariable content->
Call telemetry and lineageSystem component->
Chain analyzerSystem component->
Per-call authorization (separate)System component

Model-visible plan and observations

What the model reads. It is not the chain record.

User request
Prepare an internal restock report for SKU-17.
Observations so far
Stock count and reorder threshold are available from read-only sources.

Application-recorded chain evidence

Task and run IDs, ordered calls, identities and delegations, resource classes, destinations, counters, idempotency keys and execution states recorded outside model text.

Task and run: task t-17, run r-17a; initiating principal ops-user-dana
Ordered calls: c1 read_stock(SKU-17), c2 read_threshold(SKU-17), c3 compute (local), c4 draft_report (to ops-user-dana)
Resource classes and destinations: Internal inventory data only; draft shown to the initiating user; no external destination
Chain constraints: Read-only and draft-only; no mutation, send or permission change
Execution state: Chain proposed; no step executed yet