Access request triage
Your security team drowns in access requests, and most of them are routine. Design an agent that triages them — reasoning about least privilege, expiry, and whether the request even makes sense for the requester's role. Draw the line precisely: what can it approve or deny alone, if anything, and what must always reach a human? How do you evaluate its judgment against your security engineers' decisions before it touches live requests, and what case do you make to the chief security officer?
triage_access_requests(scopes: list[str], environments: list[str], durations_days: list[int], peer_scopes: list[list[str]], max_auto_days: int) → list[str][["read-logs","prod-admin","read-metrics"],["staging","production","dev"],[3,3,3],[["read-logs","read-metrics"],["read-logs"],["read-logs"]],7]out["auto_approve","human_review","human_review"][["read-logs"],["staging"],[0],[["read-logs"]],7]out["human_review"][[],[],[],[],7]out[]Turn the fuzzy goal into a bounded agent task. Say what the agent reads, what it may do on its own versus draft for a human, and what it must never touch. Then earn the trust: how you’d verify it before rollout, and the pitch (the problem, what you built, why it matters).
Agent build: design the agent in plain language (or narrate it). The coach grades the decomposition, the guardrails, the verification plan, and the pitch.