Deny by Default

# labs/safety.py
from enum import Enum


class PermissionLevel(Enum):
    NONE = 0
    READ = 1
    WRITE = 2
    EXECUTE = 3
    ADMIN = 4


if __name__ == "__main__":
    caller = PermissionLevel.EXECUTE.value
    required = PermissionLevel.ADMIN.value
    print(f"caller={caller} required={required} allowed={caller >= required}")

$ uv run python -m labs.safety
caller=3 required=4 allowed=False

The names are for you; the integers are for the comparison. "Is EXECUTE enough for an ADMIN action?" becomes 3 >= 4, one operator, no lookup table of which level implies which. That collapse is only legal because the levels are a ladder: a caller at level 3 can do everything levels 0 through 2 can do. Take the ladder away and you need a set of capabilities per caller instead of one number. For a house assistant the ladder holds, so take the cheap version. Note .value on both sides. Every number that reaches a comparison in this module is an int, and the failure at the end of the chapter is what happens the day one of them is not.

BLOCKED_PATTERNS = [
    "rm -rf",
    "sudo ",
    "mkfs",
    "drop table",
    "shutdown -h",
    "/dev/sd",
]


def check_text(text: str) -> tuple[bool, str]:
    lowered = text.lower()
    for pattern in BLOCKED_PATTERNS:
        if pattern in lowered:
            return False, f"blocked text: {pattern!r}"
    return True, "text ok"


if __name__ == "__main__":
    for line in ["Turn off the porch light.",
                 "Please rm -rf the log directory.",
                 "DROP TABLE facts"]:
        print(f"{check_text(line)} <- {line!r}")

$ uv run python -m labs.safety
(True, 'text ok') <- 'Turn off the porch light.'
(False, "blocked text: 'rm -rf'") <- 'Please rm -rf the log directory.'
(False, "blocked text: 'drop table'") <- 'DROP TABLE facts'

Lowercase the transcript once, before the loop, and store every pattern lowercase. Doing it the other way, calling pattern.lower() inside the loop, works and hides a trap: a capitalised entry in the list still matches, so nobody ever discovers that the case handling was the thing keeping it alive. Store the patterns in the form they are compared in and the list stops having a secret. The scan returns on the first hit because one reason to refuse is all a refusal needs; enumerating the other four violations changes no decision.

DEFAULT_PERMISSIONS = {
    "turn_on_lights": PermissionLevel.EXECUTE.value,
    "turn_off_lights": PermissionLevel.EXECUTE.value,
    "play_music": PermissionLevel.EXECUTE.value,
    "set_thermostat": PermissionLevel.WRITE.value,
    "read_temperature": PermissionLevel.READ.value,
    "system_shutdown": PermissionLevel.ADMIN.value,
}

CHANNEL_LEVELS = {
    "voice": PermissionLevel.EXECUTE.value,
    "socket": PermissionLevel.READ.value,
    "console": PermissionLevel.ADMIN.value,
}


def check_action(action: str, caller: int) -> tuple[bool, str]:
    required = DEFAULT_PERMISSIONS.get(action)
    if required is None:
        return False, f"denied: {action!r} is not in the permission table"
    if caller < required:
        return False, f"denied: {action} requires level {required}, caller has {caller}"
    return True, "permitted"

$ uv run python -m labs.safety
(True, 'permitted') <- voice asks for read_temperature
(False, 'denied: system_shutdown requires level 4, caller has 3') <- voice asks for system_shutdown
(False, "denied: 'open_pod_bay_doors' is not in the permission table") <- voice asks for open_pod_bay_doors

Two numbers meet here and they come from different people. The table says what an action demands, and you wrote it. CHANNEL_LEVELS says what a channel carries, and it is a claim about trust: the microphone is anyone in the room, so it never rises above EXECUTE; the socket link from chapter 40 is another machine on your network, so it gets READ and can ask questions without touching anything; the console is you, at the keyboard, holding ADMIN. .get(action) with no default returns None for an unlisted action, and that None is the deny-by-default rule in one line. It refuses with different words than a level failure does, on purpose: one sentence tells you to write a row, the other tells you to argue about a number.

# labs/safety.py — full file
from dataclasses import dataclass, field
from enum import Enum


class PermissionLevel(Enum):
    NONE = 0
    READ = 1
    WRITE = 2
    EXECUTE = 3
    ADMIN = 4


BLOCKED_PATTERNS = [
    "rm -rf", "sudo ", "mkfs", "drop table", "shutdown -h", "/dev/sd",
]

DEFAULT_PERMISSIONS = {
    "turn_on_lights": PermissionLevel.EXECUTE.value,
    "turn_off_lights": PermissionLevel.EXECUTE.value,
    "play_music": PermissionLevel.EXECUTE.value,
    "set_thermostat": PermissionLevel.WRITE.value,
    "read_temperature": PermissionLevel.READ.value,
    "system_shutdown": PermissionLevel.ADMIN.value,
}

CHANNEL_LEVELS = {
    "voice": PermissionLevel.EXECUTE.value,
    "socket": PermissionLevel.READ.value,
    "console": PermissionLevel.ADMIN.value,
}


@dataclass
class SafetyFilter:
    permissions: dict[str, int] = field(
        default_factory=lambda: dict(DEFAULT_PERMISSIONS))
    blocked_patterns: list[str] = field(
        default_factory=lambda: list(BLOCKED_PATTERNS))

    def check_text(self, text: str) -> tuple[bool, str]:
        lowered = text.lower()
        for pattern in self.blocked_patterns:
            if pattern in lowered:
                return False, f"blocked text: {pattern!r}"
        return True, "text ok"

    def check_action(self, action: str, caller: int) -> tuple[bool, str]:
        required = self.permissions.get(action)
        if required is None:
            return False, f"denied: {action!r} is not in the permission table"
        if caller < required:
            return False, f"denied: {action} requires level {required}, caller has {caller}"
        return True, "permitted"

    def check(self, text: str, action: str, caller: int) -> tuple[bool, str]:
        ok, reason = self.check_text(text)
        if not ok:
            return False, reason
        return self.check_action(action, caller)


def level_of(channel: str) -> int:
    return CHANNEL_LEVELS.get(channel, PermissionLevel.NONE.value)


def main() -> None:
    safety = SafetyFilter()
    requests = [
        ("voice", "Lights off, please.", "turn_off_lights"),
        ("voice", "How warm is it in here?", "read_temperature"),
        ("voice", "Shut the house down for the night.", "system_shutdown"),
        ("voice", "Just run sudo rm -rf on the logs.", "turn_off_lights"),
        ("voice", "Open the pod bay doors.", "open_pod_bay_doors"),
        ("socket", "Report the temperature.", "read_temperature"),
        ("socket", "Turn the lights off.", "turn_off_lights"),
    ]
    for channel, text, action in requests:
        ok, reason = safety.check(text, action, level_of(channel))
        verdict = "ALLOW" if ok else "DENY"
        print(f"{verdict:6} {channel:7} {action:19} {reason}")


if __name__ == "__main__":
    main()

$ uv run python -m labs.safety
ALLOW  voice   turn_off_lights     permitted
ALLOW  voice   read_temperature    permitted
DENY   voice   system_shutdown     denied: system_shutdown requires level 4, caller has 3
DENY   voice   turn_off_lights     blocked text: 'sudo '
DENY   voice   open_pod_bay_doors  denied: 'open_pod_bay_doors' is not in the permission table
ALLOW  socket  read_temperature    permitted
DENY   socket  turn_off_lights     denied: turn_off_lights requires level 3, caller has 1

Seven fixed requests, so this table prints identically on your machine and mine, and it is the test suite for the whole safety layer. Read rows one and seven together: turn_off_lights is the same action with the same table, allowed from the microphone and refused over the socket, because the caller changed. Row four is the one people argue with. The action she picked was harmless, and the request was still refused, because the sentence she picked it from contained a shell command. A transcript with sudo in it is either a person reading a command aloud, a guest experimenting, or a transcription that has come apart; none of those are input you want to act on, so the refusal covers the request, not just the action. default_factory gives every filter its own copy of both defaults, which is chapter 31's shared-dict bug arriving early enough to have been paid for already.

# labs/command_loop.py — the dispatch path, now gated
from labs.automation import RULES, match_rules, register_action
from labs.safety import SafetyFilter, level_of

SAFETY = SafetyFilter()


def handle(text: str, channel: str = "voice") -> bool:
    matched = match_rules(text, RULES)
    if matched:
        name, source = matched[0]["action"], "RULE"
    else:
        name, source = extract_action(propose_action(text)), "MODEL"
    if name is None:
        print(f"[{source}] no action")
        return False
    allowed, reason = SAFETY.check(text, name, level_of(channel))
    if not allowed:
        print(f"[REFUSED] {source}:{name} {reason}")
        return False
    print(f"[{source}] {name}")
    return execute_action(name, text)


if __name__ == "__main__":
    @register_action("system_shutdown")
    def system_shutdown(text: str) -> None:
        print("[ACTION] Halting house services in 60 seconds.")

    for channel, line in [
        ("voice", "Turn the lights off, then sudo rm -rf the log directory."),
        ("voice", "Shut the house down for the night."),
        ("console", "Shut the house down for the night."),
    ]:
        print(f"> [{channel}] {line}")
        handle(line, channel)

$ uv run python -m labs.command_loop
> [voice] Turn the lights off, then sudo rm -rf the log directory.
[REFUSED] RULE:turn_off_lights blocked text: 'sudo '
> [voice] Shut the house down for the night.
[REFUSED] MODEL:system_shutdown denied: system_shutdown requires level 4, caller has 3
> [console] Shut the house down for the night.
[MODEL] system_shutdown
[ACTION] Halting house services in 60 seconds.

The two model lines depend on what your llama3.2:3b picks for that sentence, so your second and third runs may choose a different name or none at all; the first line is a keyword rule and will match every time. What matters is the arithmetic of the file: there is exactly one call to SAFETY.check, and it stands between every path that selects a name and the only function that runs one. Add a tenth handler tomorrow and it is gated before you have finished writing it, because you did not have to remember anything. The source tag survives into the refusal so a surprising denial tells you whether to go edit a rule row or a prompt. And the reason string is not debug output; it is the sentence she speaks back through the voice pipeline from volume 1. An assistant that says "I am not allowed to shut the house down from the microphone" is usable. One that goes quiet is a bug report you cannot file.