User Authorization

# User-level authorization for agent actions
class UserAuthorizationChecker:
    def __init__(self):
        # Map actions to minimum user role required
        self.action_requirements = {
            "view_orders":     ["viewer", "support", "manager", "admin"],
            "issue_refund":    ["support", "manager", "admin"],
            "large_refund":    ["manager", "admin"],   # > $500
            "bulk_delete":     ["admin"],
            "export_all_data": ["admin"],
        }

        # User roles and their data access scope
        self.user_scopes = {
            "alice@example.com": {"role": "support",  "region": "EU",   "max_refund": 100},
            "bob@example.com":   {"role": "manager",  "region": "ALL",  "max_refund": 1000},
            "carol@example.com": {"role": "viewer",   "region": "US",   "max_refund": 0},
        }

    def authorize(self, user_email: str, action: str, context: dict = None) -> dict:
        context = context or {}
        user = self.user_scopes.get(user_email)

        if not user:
            return {"authorized": False, "reason": f"Unknown user: {user_email}"}

        allowed_roles = self.action_requirements.get(action, [])
        if user["role"] not in allowed_roles:
            return {"authorized": False,
                    "reason": f"Role '{user['role']}' cannot perform '{action}'"}

        # Check value-based limits
        if action == "issue_refund":
            amount = context.get("amount", 0)
            if amount > user["max_refund"]:
                return {"authorized": False,
                        "reason": f"Refund $" + str(amount) + " exceeds user limit $" + str(user['max_refund'])}

        return {"authorized": True, "user_role": user["role"]}

auth = UserAuthorizationChecker()
print(auth.authorize("alice@example.com", "issue_refund", {"amount": 50}))   # True
print(auth.authorize("alice@example.com", "issue_refund", {"amount": 500}))  # False (over limit)
print(auth.authorize("carol@example.com", "issue_refund", {"amount": 10}))   # False (role)
print(auth.authorize("bob@example.com",   "bulk_delete",  {}))               # False (role)