Access boundaries

Directory examples/python/features/access_boundaries

Run a restricted caller against server-enforced rules. The node contains no authorization logic; boundaries.py configures policies and attempts operations that should be refused.

Agent node label concierge, version 1.0.0.

Capabilities

Capability	Kind	Signature	Module	Summary
`itinerary`	skill	`(ticket: str) -> dict`	`examples/python/features/access_boundaries/agent.py`	Read one fixture itinerary.
`quote`	traversal	`(city: str, nights: int = 1, budget_aud: float = 0.0, currency: str = 'AUD') -> dict`	`examples/python/features/access_boundaries/agent.py`	Quote accommodation from the fixture rate card.
`refund`	traversal	`(ticket: str, amount_aud: float) -> dict`	`examples/python/features/access_boundaries/agent.py`	The capability a partner integration must never reach.

Commands

Taken from this example's own README and module docstrings.

ATFGRAPH_API_KEY=local-concierge-node \
ATFGRAPH_CONFIG_FILE=examples/python/features/access_boundaries/config.example.yaml \
python -m atfgraph.worker --module examples.python.features.access_boundaries.agent:app
python -m examples.python.features.access_boundaries.boundaries

Files

examples/python/features/access_boundaries/README.md
examples/python/features/access_boundaries/__init__.py
examples/python/features/access_boundaries/agent.py
examples/python/features/access_boundaries/agentnode.yaml
examples/python/features/access_boundaries/boundaries.py
examples/python/features/access_boundaries/config.example.yaml

README

Rendered from examples/python/features/access_boundaries/README.md; the source file is not modified.

Run a restricted caller against server-enforced rules. The node contains no authorization logic; boundaries.py configures policies and attempts operations that should be refused.

ATFGRAPH_CONFIG_FILE=examples/python/features/access_boundaries/config.example.yaml \
  target/debug/atfgraphd
ATFGRAPH_API_KEY=local-concierge-node \
  python -m atfgraph.worker --module examples.python.features.access_boundaries.agent:app
python -m examples.python.features.access_boundaries.boundaries

The sample config defines operator (admin), concierge-node (admin/worker), and partner (invoke) on a scratch database. Tokens are throwaway loopback fixtures. The driver accepts $ATFGRAPH_OPERATOR_TOKEN and $ATFGRAPH_PARTNER_TOKEN overrides.

The two mechanisms

Access policies at /api/v2/access/policies match a principal, label and capability to restrict submissions:

Policy	Effect on `partner`
`deny` on `concierge.refund`	every refund submission is `403 policy_denied`
`allow` on `concierge.quote` with constraints `currency == AUD`, `nights <= 7`	a 14-night quote is `403 constraint_denied`
`allow` on `concierge.itinerary` with `rate: 0.001/s, burst: 2`	the third call in a burst is `429 rate_limited`

Constraints inspect submitted values, so a required currency cannot be omitted in expectation of a handler default. An allow rule narrows existing role permissions. A refused submission creates no traverser and starts no handler; it therefore incurs no handler/model usage.

Connector manifests restrict a principal to named API operations. This partner may submit/read runs, read paths and inspect capabilities. Listing agents still returns 403 connector_forbidden, despite the invoke role. Callers can read their manifest at /api/v2/access/connector; /api/v2/access/evaluate previews an operation without consuming a rate token.

Revocation is stored. After /api/v2/access/connectors/partner/revoke, the principal remains refused rather than reverting to ordinary token access. Re-running the driver binds its manifest again.

The same server checks apply to MCP, A2A and emitter submissions. Selecting another protocol does not bypass the configured rules.

The extended-feature test suite checks these outcomes against a real local daemon. The example config remains a test fixture, not a production identity setup.