Our linter's "safe" autofix would have silently disabled RBAC

KubeIntellect, an AI agent that operates on live clusters using kubectl, relies on a role check and human-approval gate for its tools. These security measures depend on the tool receiving the correct run configuration, which is facilitated by an annotated RunnableConfig parameter. However, the default value None is not explicitly stated in the annotation, leading to potential issues when mypy, Ruff, or LangChain attempt to process the parameter.

The annotation is critical because it loads the parameter for injection. When the annotation is not correctly formed, the parameter defaults to None, preventing the injection of the expected RunnableConfig. As a result, the tool runs with config=None, causing the caller's role to be lost, and the fallback defaults to admin. This alteration allows a read-only API key to no longer be read-only, and the permission denial check still functions, despite the altered role.

The issue arises because the guard test fails to catch the improper annotation, allowing the code to pass unnoticed. The result is that the human-approval gate, which defaults to False without the config, prompts the user more often instead of less. The RBAC default becomes a safety concern, as it fails open rather than maintaining strict access controls.

To address this, the article explains the implementation of a guard test. The guard scans every config: Annotated[..., InjectedToolArg] parameter in the source code and fails if any is not the bare RunnableConfig. Dynamic canaries are also included to build a real tool with each spelling and assert against the installed langchain version, ensuring that a change in the library would trigger a test failure.

The guard is crucial to prevent further occurrences of this issue, as it ensures that the correct annotation is enforced throughout the codebase.