Securing AI Agents with RBAC Pre-Invoke Plugins in watsonx Orchestrate: Multi-Role Authorization

WXO Labs Series Icon By Markus van Kempen | Series: WXO Labs & Tutorial Guide (Part 9 of 15)
Interactive Lab Portal: https://markusvankempen.github.io/wxo-labs/
GitHub Repository: https://github.com/markusvankempen/wxo-labs

Securing AI Agents with RBAC Pre-Invoke Plugins in watsonx Orchestrate: Multi-Role Authorization

Why This Pattern Matters

Some AI agents have access to privileged actions (rebooting servers, deleting records, viewing payroll). Before the agent's LLM even processes a user prompt, a pre-invoke plugin intercepts the request, verifies the caller's enterprise roles, and terminates execution immediately if unauthorized.

📋 Prerequisites & Setup

Ensure your environment has the required dependencies:

pip install ibm-watsonx-orchestrate

Verify active environment:

orchestrate env list

🛠️ Step 1: Implement the Logic (rbac_plugin.py)

from ibm_watsonx_orchestrate import plugin

ROLE_DIRECTORY = {
    "markus@ca.ibm.com": ["admin", "devops"],
    "alice@company.com": ["manager"],
    "guest@partner.com": ["viewer"]
}

PERMITTED_ROLES = ["admin", "devops"]

@plugin
def rbac_pre_invoke(plugin_context) -> dict:
    """
    Pre-invoke security gatekeeper.
    Evaluates caller identity against access control rules before LLM invocation.
    """
    context = plugin_context.state.get("context", {})
    user_email = context.get("wxo_email_id", "guest@partner.com")
    assigned_roles = ROLE_DIRECTORY.get(user_email, [])

    is_authorized = any(role in PERMITTED_ROLES for role in assigned_roles)

    if is_authorized:
        return {"continue_processing": True}
    else:
        return {
            "continue_processing": False,
            "message": f"""
🚫 Access Denied (HTTP 403 Forbidden)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
User:      {user_email}
Required:  {", ".join(PERMITTED_ROLES)}
Assigned:  {", ".join(assigned_roles) if assigned_roles else "None"}

You do not possess the required security roles to interact with this agent.
Contact the security operations desk for role escalation.
"""
        }

📦 Step 2: Declare Dependencies (requirements.txt)

ibm-watsonx-orchestrate>=2.9.0

🤖 Step 3: Configure the AI Agent (agent.yaml)

spec_version: v1
kind: native
name: devops_remediation_agent
title: "DevOps Infrastructure Remediation Agent"
description: "High-privilege agent restricted to certified DevOps admins."
model: ibm/granite-3-8b-instruct
pre_invoke_plugins:
  - rbac_pre_invoke
instructions: |
  You are an infrastructure recovery assistant with cluster administration rights.
tools:
  - restart_kubernetes_pod

🚀 Step 4: Import & Test Live in Terminal

Import tool and test conversationally:

orchestrate chat ask -n devops_remediation_agent "Restart production payment pod"

Live Response:

╭─ 🚫 rbac_pre_invoke ───────────────────────────────────────────────────╮
│                                                                        │
│  🚫 Access Denied (HTTP 403 Forbidden)                                 │
│  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━                             │
│  User:      guest@partner.com                                          │
│  Required:  admin, devops                                              │
│  Assigned:  viewer                                                     │
│                                                                        │
│  You do not possess the required security roles to interact.           │
╰────────────────────────────────────────────────────────────────────────╯

💡 Pro Tips & Gotchas

🏷️ Recommended Community Tags

When publishing this blog post, select or enter the following tags in the community editor:

watsonx Orchestrate, RBAC, Pre-Invoke Plugins, Agent Security, Authorization, Access Control

🗺️ Series Roadmap (15 Hands-On Labs)

This tutorial is Part 9 of 15 in the complete enterprise hands-on series:

Explore the interactive curriculum and code repository: