A tool-using agent with separate read and write identities, an approval gate, audit trace, and kill switch.
Education← BRAINS pathwayBRAINS · Masterclass
Identity, Integrity, and Intervention
Give the agent enough authority to work without handing it every key.
Design identities, permissions, approval gates, audit evidence, containment, and recovery around consequence.
Permission matrix, approval policy, redacted audit trace, incident runbook, and controlled recovery.
Permissioned Tool Agent
Class requirement: create or sign in to your Alternate Clouds account, deploy the Permissioned Tool Agent template, and submit its live URL before the class is marked complete.
Create your Alternate Clouds account ↗Copyright and rights clearance
Use only work you own or are authorized to use.
Every submission needs a source-and-license manifest covering text, code, images, audio, video, fonts, datasets, models, weights, and AI reference inputs. Attribution alone is not permission. Questionable material stays private or is replaced before deployment or showcase.
Ask about rights clearance01Whose action was it?+
Separate human, workload, agent, and delegated identities across the task trace.
Applied exercise
Label every identity and credential in one representative action.
02Permission by consequence+
Distinguish read, propose, approve, execute, and irreversible action classes.
Applied exercise
Assign approval thresholds to ten tool actions.
03Integrity and evidence+
Preserve provenance and attribution without logging secrets or unnecessary private content.
Applied exercise
Design the minimum audit record needed to explain one disputed action.
04Incident and recovery+
Revoke, stop, preserve evidence, restore state, and replay safely.
Applied exercise
Trigger an unauthorized write, prove it was blocked, rotate the credential, and resume once.
The complete course adds the teaching deck, Alternate Clouds lab, source-bounded guide, review rubric, and instructor feedback.
Find a class