hallpass: check the user's real permissions before a Strands tool acts

[roee-hersh]

I run an internal ops agent on Strands. It reads everything (health, events, metrics, pipeline logs) on a read-only account and I don't gate reads. It changes things one way only: a PR against the GitOps repo. The gap: the bot's token could open that PR for anyone who asked, including people who can't push to that repo themselves.

hallpass closes it. Before the tool acts, it asks the system that owns the resource (GitHub here; also Kubernetes, Argo CD, Jira, AWS, 21 total) whether this specific person is allowed, and answers allow, deny or unknown. Unknown means the tool doesn't run. It never performs the action.

In Strands it's one decorator on the tool. The user comes from your session, never from the model, so the tool schema has no user field:

from strands import tool
from hallpass_client import Hallpass, guarded

@tool
@guarded(hp, "github-main", "repo.push", "repo:{owner}/{repo}", user=current_user)
def open_config_pr(owner: str, repo: str, patch: str) -> str:
    """Push a branch with the change and open a pull request for it."""
    ...

Tested through Strands' own tool path: the schema exposes only the real arguments, and an injected user in the tool input is ignored. Full example: examples/agent/strands_tool.py. Single binary, Apache 2.0.

https://github.com/roee-hersh/hallpass

Would love to know if there's a more idiomatic place to hook this in (a BeforeToolCallEvent hook instead of a decorator?).