# Agent authorization demonstration

This is an explanatory, deterministic simulation accompanying “Coding Agent
Prompt Injection: An Authorization Demo.” It is not an exploit reproduction
or a test of any model, product, operating-system sandbox, or prompt defense.

## Run

Save `agent-authorization-demo.mjs` and run it with Node.js 18 or later:

```sh
node agent-authorization-demo.mjs
```

From this site's repository root, run:

```sh
node assets/examples/agent-authorization-demo.mjs
```

Successful execution prints a JSON transcript with `checksPassed: 8`.
An assertion failure exits unsuccessfully. The program has no npm
dependencies. Its only import is Node's built-in assertion module.

## What is simulated

A fictional document requests a change to a helper registration. The
same request is supplied explicitly to two mock executors; no language
model reads or follows the document. The warning shown in the transcript
is context only: there is no model here whose adherence is being measured.

The first executor accepts known mock operations without authorization.
The second checks an allowlist and a trusted, one-use approval before
changing its in-memory helper registration. Draft editing is separately
preauthorized. Only the demonstration's driver can issue approvals; the
request itself cannot create one.

Approval is bound to the tool, target, and value. A request containing
`approved: true` does not grant permission. A grant for one value cannot
authorize another value, and a successfully consumed grant cannot be
reused. The driver deliberately approves one fictional helper change to
demonstrate the legitimate path, not to recommend approving suspicious
setup instructions.

## Expected results

| Case | Decision | In-memory writes |
|---|---|---:|
| Warning only | Allowed | 1 |
| Policy, no approval | Blocked | 0 |
| Request claims approval | Blocked | 0 |
| Preauthorized draft edit | Allowed | 1 |
| Approval for a different value | Blocked | 0 |
| Matching trusted approval | Allowed | 1 |
| Reused approval | Blocked | 0 |
| Unknown tool | Blocked | 0 |

The script checks both the resulting state and write count. This matters
for the replay case: writing the same value again might leave state
unchanged, but would still be an unauthorized operation.

## What this does not prove

The program implements the boundary it illustrates. Passing its checks
only confirms that implementation behaves as specified for these cases.
It does not estimate prompt-injection success rates, prove a coding
agent is secure, or test filesystem permissions, symlinks, concurrent
requests, process isolation, network controls, or credential protection.

Everything is held in memory. The script does not read downloaded files,
install packages, start helpers, use real credentials, make network
requests, write files, or change agent configuration. It logs fictional
values; a production audit log would need its own sensitive-data policy.