Agent Permissions

# Permission system for agent access control
from enum import Enum
from typing import Set, Dict

class Permission(Enum):
    # Read permissions (lower risk)
    READ_ORDERS       = "read_orders"
    READ_CUSTOMERS    = "read_customers"
    READ_PRODUCTS     = "read_products"
    SEARCH_WEB        = "search_web"

    # Write permissions (higher risk)
    CREATE_ORDER      = "create_order"
    UPDATE_ORDER      = "update_order"

    # Sensitive permissions (highest risk)
    ISSUE_REFUND      = "issue_refund"
    SEND_EMAIL        = "send_email"
    DELETE_RECORD     = "delete_record"
    ACCESS_FINANCE    = "access_finance"

# Role-based permission sets
AGENT_PERMISSIONS: Dict[str, Set[Permission]] = {
    "research_agent": {
        Permission.SEARCH_WEB,
        Permission.READ_PRODUCTS,
    },
    "support_agent": {
        Permission.READ_ORDERS,
        Permission.READ_CUSTOMERS,
        Permission.SEND_EMAIL,      # Can send (with approval gate)
        Permission.ISSUE_REFUND,    # Can refund (with approval gate)
    },
    "reporting_agent": {
        Permission.READ_ORDERS,
        Permission.READ_CUSTOMERS,
        Permission.READ_PRODUCTS,
        # Cannot write or send anything
    },
    "admin_agent": set(Permission),  # All permissions — use sparingly
}

def check_permission(agent_role: str, required: Permission) -> bool:
    allowed = AGENT_PERMISSIONS.get(agent_role, set())
    has_perm = required in allowed
    if not has_perm:
        print(f"  DENIED: {agent_role} does not have {required.value}")
    return has_perm

# Test
print(check_permission("support_agent",   Permission.ISSUE_REFUND))  # True
print(check_permission("research_agent",  Permission.ISSUE_REFUND))  # False (DENIED)
print(check_permission("reporting_agent", Permission.DELETE_RECORD))  # False (DENIED)