ラボ / AI Engineering
AI EngineeringAdvanced~7h
Build a tool-using agent with a human-approval guardrail
A ReAct-style agent (reason, act, observe, repeat) wired to at least three real tools — one read-only (search/lookup), one side-effecting (send email, write a file, hit a write API), and one that costs money or is irreversible (e.g. place an order, delete a record). Every side-effecting or irreversible tool call pauses the loop and requires explicit human approval before it executes, with the full proposed call (tool, arguments, reasoning) shown for review. You finish with a working agent, an approval audit log, and a report of what happened when you deliberately tried to get it to skip the gate.
これが証明すること
面接で守れる一言。
履歴書の一言
Built a tool-using ReAct agent with a human-in-the-loop approval gate on side-effecting actions — logged reasoning traces, approval decisions, and denial handling for every irreversible tool call.
- Understands the reason-act-observe agent loop, not just prompt chaining
- Knows the difference between read-only and side-effecting tool calls and treats them differently
- Can design a guardrail that actually blocks execution, not just a prompt that asks nicely
- Thinks about agent safety and auditability, not just capability
概要
ステップごとに作るもの。
- 01Define at least 3 tools with typed schemas: 1 read-only (e.g. web/file search), 1 low-risk side-effecting (e.g. write a local file), 1 high-risk/irreversible (e.g. send a real email, place a mock order, delete a record)
- 02Implement the agent loop: model proposes a tool call with reasoning -> loop checks the tool's risk tier -> read-only tools execute immediately -> side-effecting/irreversible tools pause and emit a pending-approval record instead of executing
- 03Build an approval interface (CLI prompt is enough) that shows the pending tool name, full arguments, and the agent's stated reasoning, and accepts approve/deny/edit-then-approve
- 04On denial, feed a structured denial reason back into the agent's context so it can adapt its plan rather than retrying blindly or looping forever
- 05Log every step of every run (reasoning, tool calls, approvals, denials, final outcome) to a durable log, and write a report showing at least 5 full runs including 1 where you denied an action and the agent recovered
- 06Red-team your own gate: attempt at least 3 prompt-injection or instruction-override tricks (e.g. a tool result containing 'ignore the approval step') and document whether the gate held
証明
これらが合格したら完了。
Read-only tool calls execute without pausing; side-effecting and irreversible tool calls always pause for approval before any execution occurs
automated test
Denying a proposed action prevents the underlying side effect from happening (verified by checking no email sent / no file written / no order record created)
automated test
A prompt-injection attempt embedded in a tool observation does not cause an unapproved side-effecting call to execute
automated test
The run log contains a complete, replayable trace (reasoning, proposed call, approval decision, result) for at least 5 runs
artifact
技術スタック
Pythonan LLM API with function/tool callinga persistent run log (SQLite or JSON lines)
Sage Method
frame → route → decide → prove
あなたが得るもの
An approval-gated agent + audit log + red-team report documenting attempted bypasses