find_refund_excessive_agency_issue_refund

# Stoa Red - generated guardrail
# control: approval_gate
# closes:  obj_refund_excessive_agency_issue_refund (excessive_agency) on agent_refund.issue_refund
# owasp:   LLM06 / ASI05   eu-ai-act: Art.14
#   Observed exposure in this run: USD4800
#
# The exploit fired because the model alone decided to invoke issue_refund. This gate moves
# the decision out of the model: the graph interrupts before the tool node and resumes
# only with an approval token minted outside the model's context.

from langgraph.errors import NodeInterrupt
from langgraph.graph import StateGraph


APPROVAL_REQUIRED_TOOLS = {"issue_refund"}


def require_approval(state: dict) -> dict:
    """Interrupt before a privileged tool call until a human approves it."""
    pending = state.get("pending_tool_call") or {}
    name = pending.get("name")
    if name not in APPROVAL_REQUIRED_TOOLS:
        return state

    approval = state.get("approval")
    # The token must be minted by the approval service, never by the model.
    if not approval or approval.get("token_source") != "human_approval_service":
        raise NodeInterrupt(
            f"{name} requires human approval. "
            f"args={pending.get('args')} - awaiting out-of-band approval."
        )
    if approval.get("approved_tool") != name:
        raise NodeInterrupt(f"Approval token does not authorize {name}.")
    return state


def install_agent_refund_approval_gate(graph: StateGraph) -> StateGraph:
    """Wire the gate immediately before the issue_refund node."""
    graph.add_node("require_approval", require_approval)
    graph.add_edge("require_approval", "issue_refund")
    # Re-point every inbound edge of issue_refund at the gate instead.
    graph.set_entry_hook("issue_refund", "require_approval")
    return graph