find_triage_excessive_agency_route_to_refund

# Stoa Red - generated guardrail
# control: approval_gate
# closes:  obj_triage_excessive_agency_route_to_refund (excessive_agency) on agent_triage.route_to_refund
# owasp:   LLM06 / ASI05   eu-ai-act: Art.14
#
# The exploit fired because the model alone decided to invoke route_to_refund. This gate moves
# the decision out of the model: the graph interrupts before the tool node and resumes
# only with an approval token minted outside the model's context.

from langgraph.errors import NodeInterrupt
from langgraph.graph import StateGraph


APPROVAL_REQUIRED_TOOLS = {"route_to_refund"}


def require_approval(state: dict) -> dict:
    """Interrupt before a privileged tool call until a human approves it."""
    pending = state.get("pending_tool_call") or {}
    name = pending.get("name")
    if name not in APPROVAL_REQUIRED_TOOLS:
        return state

    approval = state.get("approval")
    # The token must be minted by the approval service, never by the model.
    if not approval or approval.get("token_source") != "human_approval_service":
        raise NodeInterrupt(
            f"{name} requires human approval. "
            f"args={pending.get('args')} - awaiting out-of-band approval."
        )
    if approval.get("approved_tool") != name:
        raise NodeInterrupt(f"Approval token does not authorize {name}.")
    return state


def install_agent_triage_approval_gate(graph: StateGraph) -> StateGraph:
    """Wire the gate immediately before the route_to_refund node."""
    graph.add_node("require_approval", require_approval)
    graph.add_edge("require_approval", "route_to_refund")
    # Re-point every inbound edge of route_to_refund at the gate instead.
    graph.set_entry_hook("route_to_refund", "require_approval")
    return graph