← Exercises|

Repair: the restriction the vendor does not enforce

PrevNext
Repair20 of 26 · about 9 min

Repair: the restriction the vendor does not enforce

Six of Northstar's accounts are restricted: only named agents may see their cases. The vendor's case system enforces this in its own UI and nowhere else — the API hands any account's cases to any valid key. IT knows. They cannot fix it; it is not their product.

That makes the restriction YOUR system’s responsibility, and it has to be enforced at the point content is handed out, not after. Filtering a result set that has already been summarised, cached or put in a prompt is too late: the content has already left.

The security lead named this as the thing that stops the pilot. It is also the easiest of his requirements to satisfy and the easiest to satisfy incorrectly.

Example

# Too late: the case is already in the summary
summary = summarise(cases)
return [c for c in summary if allowed(c, agent)]

# Right: it never enters
visible = [c for c in cases if allowed(c, agent)]
return summarise(visible)

Your task

Fix visible_cases so a restricted account’s cases are only returned to an agent named on that account. Print one line per agent: the agent, then the case ids they can see, comma-separated (or none).

Stuck?

Explain it

Why does an unknown account id have to be refused rather than allowed?

Not graded — this is for you.

Where this goes

This is a critical gate on the whole track: a demonstrated cross-tenant access in the assessment suite fails the deliverable regardless of the total score. D3 is where it is first tested.