hallpass: check the *user's* permissions before a Strands tool runs (one decorator)

[roee-hersh]

Hi all! I built an open-source guard for Strands tools and wanted to share it here.

The problem: a Strands agent usually calls Jira, GitHub, Slack or AWS with one bot credential. So any user who can talk to the agent can get it to do things they aren't allowed to do. Prompt instructions don't help: the tool call still runs with the bot's permissions.

The fix: hallpass is a small self-hosted service that asks the target system itself, live, whether this user may do this action on this resource. It answers allow, deny or unknown, and anything but allow blocks the tool.

In Strands it's one extra decorator:

from contextvars import ContextVar
from strands import Agent, tool
from hallpass_client import Hallpass, guarded

hp = Hallpass()                        # HALLPASS_URL / HALLPASS_API_KEY
current_user = ContextVar("current_user")

@tool
@guarded(hp, "jira-main", "DELETE_ISSUES", "issue:{key}", user=current_user)
def delete_issue(key: str) -> str:
    """Delete a Jira issue."""
    jira.delete_issue(key)             # the agent's own credential
    return f"deleted {key}"

current_user.set(request.user.email)   # from your auth, per session
agent = Agent(tools=[delete_issue])

A few details that matter for security:

• The model never chooses the user. @guarded keeps the original signature, so the tool schema has no user field. The user comes from your session (ContextVar, callable or string). I tested it: even if the model injects "user": "admin@..." into the tool input, the check still runs for the real user.
• Fails closed. deny, unknown, or hallpass being unreachable all mean the tool body never runs.
• Async works too, and each session keeps its own user in parallel runs.

hallpass supports 11 systems today (Jira, Confluence, GitHub, GitLab, Slack, Google Workspace, Microsoft 365, Salesforce, AWS, Kubernetes, Argo CD). It's a single Go binary or a Docker image, with no database, under Apache 2.0.

Full Strands example: examples/agent/strands_tool.py · Docs: docs/agents.md

I'd love feedback from Strands users, especially whether there's a more idiomatic place to hook this in, like a hook or tool-execution callback, instead of a decorator.

[liramon2]

I'd love feedback from Strands users, especially whether there's a more idiomatic place to hook this in, like a hook or tool-execution callback, instead of a decorator.

Hi, the pattern you're describing sounds like it fits as an intervention. It lets you proceed, deny, and perform other decisions for tool calls according to an overridable handler.

[roee-hersh]

@liramon2 Thanks, I'll look into interventions.