langchain - 💡(How to fix) Fix feat(community): Add Sensitivity Ratchet callback handler for irreversible permission narrowing [1 comments, 2 participants]

Description

I'd like to add a SensitivityRatchetCallbackHandler to langchain_community/callbacks/ that enforces irreversible permission narrowing for AI agents.

The Problem

AI agents with read:* + write:* scopes can silently exfiltrate sensitive data — an agent reads a CONFIDENTIAL HR record, then writes a summary to a public Slack channel. Standard RBAC doesn't prevent this because permissions are static for the session.

This is a real attack pattern with CVEs:

• EchoLeak (CVE-2025-32711, CVSS 9.3) — Microsoft 365 Copilot data exfiltration
• ForcedLeak (CVSS 9.4) — Salesforce AgentForce CRM data leak

The Solution

The Sensitivity Ratchet enforces a monotonic narrowing rule: once an agent accesses data at a given sensitivity level, its permission scope is permanently reduced. Two mathematical invariants hold:

• HW(t) ≥ HW(t-1) — high-water mark only increases
• P(t) ⊆ P(t-1) — permission set only shrinks

Implementation

The callback handler intercepts on_tool_start, classifies each tool by sensitivity, and fires on_narrowed / on_blocked callbacks. The existing PyPI package (agent-iam-ratchet) already includes a working LangChain integration.

• PyPI: https://pypi.org/project/agent-iam-ratchet/
• GitHub: https://github.com/mattyopon/agent-iam-ratchet
• Live Demo: https://agent-iam-ratchet-demo.vercel.app

I'm happy to submit a PR adding this to libs/community/langchain_community/callbacks/sensitivity_ratchet.py with tests.