Agent 的信任不在提示词里，而在运行时里

{
  "tool": "read_file",
  "args": {
    "path": "../../etc/passwd"
  }
}

模型生成工具请求
      ↓
结构化解析与 Schema 校验
      ↓
策略判断：身份、资源、环境、风险等级
      ↓
可选的人工审批
      ↓
沙箱或隔离进程执行
      ↓
结果裁剪、敏感信息过滤
      ↓
审计记录与可观测性事件

from pathlib import Path
import json
import sys
import time
import uuid

ROOT = Path("workspace").resolve()
AUDIT_LOG = Path("audit.jsonl")
MAX_OUTPUT_BYTES = 16 * 1024

TOOL_SCHEMAS = {
    "list_files": {"path"},
    "read_file": {"path"},
}


def confined_path(value: str) -> Path:
    if not isinstance(value, str) or not value:
        raise ValueError("path must be a non-empty string")

    candidate = (ROOT / value).resolve()
    if candidate != ROOT and ROOT not in candidate.parents:
        raise PermissionError("path escapes the workspace")
    return candidate


def limit_output(value: str) -> str:
    raw = value.encode("utf-8")
    if len(raw) <= MAX_OUTPUT_BYTES:
        return value
    return raw[:MAX_OUTPUT_BYTES].decode("utf-8", errors="ignore") + "\n[truncated]"


def list_files(args: dict) -> str:
    directory = confined_path(args["path"])
    if not directory.is_dir():
        raise ValueError("path is not a directory")
    files = sorted(str(item.relative_to(ROOT)) for item in directory.iterdir())
    return "\n".join(files)


def read_file(args: dict) -> str:
    path = confined_path(args["path"])
    if not path.is_file():
        raise ValueError("path is not a file")
    return path.read_text(encoding="utf-8")


TOOLS = {
    "list_files": list_files,
    "read_file": read_file,
}


def execute(request: dict) -> dict:
    call_id = str(uuid.uuid4())
    started = time.monotonic()

    try:
        if set(request) != {"tool", "args"}:
            raise ValueError("request must contain exactly: tool, args")

        tool_name = request["tool"]
        args = request["args"]
        if tool_name not in TOOLS:
            raise PermissionError("tool is not allowed")
        if not isinstance(args, dict) or set(args) != TOOL_SCHEMAS[tool_name]:
            raise ValueError("tool arguments do not match the schema")

        output = limit_output(TOOLS[tool_name](args))
        response = {"call_id": call_id, "ok": True, "output": output}
    except Exception as exc:
        response = {"call_id": call_id, "ok": False, "error": str(exc)}

    event = {
        "call_id": call_id,
        "tool": request.get("tool") if isinstance(request, dict) else None,
        "ok": response["ok"],
        "duration_ms": round((time.monotonic() - started) * 1000, 2),
    }
    with AUDIT_LOG.open("a", encoding="utf-8") as log:
        log.write(json.dumps(event, ensure_ascii=False) + "\n")

    return response


if __name__ == "__main__":
    ROOT.mkdir(exist_ok=True)
    request = json.load(sys.stdin)
    print(json.dumps(execute(request), ensure_ascii=False, indent=2))

mkdir -p workspace/docs
printf 'runtime policy\n' > workspace/docs/note.txt

python agent_runtime.py <<'JSON'
{
  "tool": "read_file",
  "args": {
    "path": "docs/note.txt"
  }
}
JSON

python agent_runtime.py <<'JSON'
{
  "tool": "read_file",
  "args": {
    "path": "../../etc/passwd"
  }
}
JSON

cat audit.jsonl