Demo380 — Role Based Tools

Prepare the demo

Start at the root of the complete distribution built in Release; retain shared projects and files copied beside executables. Scripted transport or heuristic by default: no model, embeddings, secret or container required. --live explicitly selects common chat without cloud fallback.

dotnet build BaseTechnique.slnx -m:1 -c Release

• Installation and initial setup

• Connections and capabilities

Run from the root

dotnet run --project demos/Demo380_RoleBasedTools/Demo380.App.csproj -c Release --no-build

Procedures and variants

With no argument, predict PermissionDenied. Then compare complete and forbidden. Leave read_ticket visible to observe the execution-time check.

var live = args.Contains("--live");
string[] scenarios = ["complete", "repeat", "forbidden", "budget", "incomplete", "deadline", "changing"];
var scenario = args.FirstOrDefault(a => scenarios.Contains(a)) ?? defaultScenario;
using var caller = new CancellationTokenSource();
var capabilities = scenario == "forbidden" ? new[] { "review.finish" } : new[] { "ticket.read", "review.finish" };
var limits = new ExecutionLimits(ModelCalls: scenario == "budget" ? 1 : 6,
    DeadlineSeconds: scenario == "deadline" ? 1 : 120);
using var scope = new ExecutionScope(capabilities, limits, caller.Token);

shared/Maf.Control/ControlDemo.cs · L14–L21 · 9a895c94534c

Source code · Maf.Control · Folder

• shared/Maf.Control/Maf.Control.csproj
• demos/Demo330_BoundedHarness/Demo330.App.csproj
• demos/Demo340_LoopControl/Demo340.App.csproj
• demos/Demo380_RoleBasedTools/Demo380.App.csproj

dotnet run --project demos/Demo380_RoleBasedTools/Demo380.App.csproj -c Release --no-build -- complete

dotnet run --project demos/Demo380_RoleBasedTools/Demo380.App.csproj -c Release --no-build -- repeat

dotnet run --project demos/Demo380_RoleBasedTools/Demo380.App.csproj -c Release --no-build -- forbidden

dotnet run --project demos/Demo380_RoleBasedTools/Demo380.App.csproj -c Release --no-build -- budget

dotnet run --project demos/Demo380_RoleBasedTools/Demo380.App.csproj -c Release --no-build -- changing

dotnet run --project demos/Demo380_RoleBasedTools/Demo380.App.csproj -c Release --no-build -- deadline

dotnet run --project demos/Demo380_RoleBasedTools/Demo380.App.csproj -c Release --no-build -- incomplete

Results, refusal and evidence

Default grants review.finish but not ticket.read: zero admitted ToolCall events and exit 2. complete selects another host fixture without administrator login. Old anonymous/support/manager/admin arguments are no longer this entry’s protocol.

Control limits

Scripted results verify actual orchestration and controls without qualifying a model or every attack. Counters are run-local; no durable idempotency or business write. Cancellation remains cooperative.

dotnet test tests/Maf.Control.Tests/Maf.Control.Tests.csproj -m:1 -c Release --no-build --no-restore

Connect contracts and prerequisites

• Untrusted data and authorization

• Demo060 — Tools Catalog

• Demo index