Tool access control

[valtzu]

Many times a tool invoked by chain performs an action that can be performed by the user manually too. This type of actions usually have some access control that may depend on the given parameters: f.e. in Symfony http context by defining #[IsGranted('post:delete', 'post')] on the controller.

Do you think it would make sense to have something similar here too, or it's outside of the scope here? I was thinking one possible solution could be to allow exposing controllers as tools. Of course you can already add #[AsTool] to an existing controller, but since the tool call does not go through Symfony HttpKernel, f.e. the IsGranted attribute is never checked. It'd be awesome if a single IsGranted attribute could cover both, the HTTP endpoint and also LLM Chain tool call.

If you think this is outside the scope, then it'd be nice to dispatch some ToolCallArgumentsEvent (analogous to ControllerArgumentsEvent) just before making the actual tool call. This way it's easy to hook into the event in user land, check the attributes and throw some AccessDeniedException.

---

Of course it's always possible to just call $this->security->isGranted(...) inside the tool, but I find declarative access control rules nicer.

[OskarStark]

Sounds like a nice idea, we already have a tool call event in place, adding a second one wouldn't hurt. It would be nice to have it then in the LLM chain Demo project.

[chr-hertel]

Yes, that's an interesting concern. I think it would be great to do this check already before providing the set of tools to the chain.

[valtzu]

I think it would be great to do this check already before providing the set of tools to the chain.

One could do some check when providing the tool list, but often actions are allowed or disallowed based on the parameters: think of "One can access document A and B but not document C". You may have millions of documents so it's not feasible to check every single document when constructing the tool set.

---

But since ToolArgumentsResolved event was already added, I think some form of access control (similar to http kernel's #[IsGranted]) should already be doable.

[valtzu]

I have a solution ready (attribute & listener), do you think it makes sense to include those in this project & wire the listener in the bundle when symfony/security-core is available?

[OskarStark]

If you have something ready please push, so we can talk about code 😄 but yes I think its a nice idea!