Securing AI Agents with RBAC Pre-Invoke Plugins in watsonx Orchestrate: Multi-Role Authorization
Intercepting agent dialogue with pre-invoke security plugins to enforce Role-Based Access Control before LLM execution.
Why This Pattern Matters
Some AI agents have access to privileged actions (rebooting servers, deleting records, viewing payroll). Before the agent's LLM even processes a user prompt, a pre-invoke plugin intercepts the request, verifies the caller's enterprise roles, and terminates execution immediately if unauthorized.
Step 1: Write Tool Logic (rbac_plugin.py)
from ibm_watsonx_orchestrate import plugin
ROLE_DIRECTORY = {
"markus@ca.ibm.com": ["admin", "devops"],
"alice@company.com": ["manager"],
"guest@partner.com": ["viewer"]
}
PERMITTED_ROLES = ["admin", "devops"]
@plugin
def rbac_pre_invoke(plugin_context) -> dict:
"""
Pre-invoke security gatekeeper.
Evaluates caller identity against access control rules before LLM invocation.
"""
context = plugin_context.state.get("context", {})
user_email = context.get("wxo_email_id", "guest@partner.com")
assigned_roles = ROLE_DIRECTORY.get(user_email, [])
is_authorized = any(role in PERMITTED_ROLES for role in assigned_roles)
if is_authorized:
return {"continue_processing": True}
else:
return {
"continue_processing": False,
"message": f"""
🚫 Access Denied (HTTP 403 Forbidden)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
User: {user_email}
Required: {", ".join(PERMITTED_ROLES)}
Assigned: {", ".join(assigned_roles) if assigned_roles else "None"}
You do not possess the required security roles to interact with this agent.
Contact the security operations desk for role escalation.
"""
}Step 2: Dependencies (requirements.txt)
ibm-watsonx-orchestrate>=2.9.0Step 3: Agent Manifest (agent.yaml)
spec_version: v1
kind: native
name: devops_remediation_agent
title: "DevOps Infrastructure Remediation Agent"
description: "High-privilege agent restricted to certified DevOps admins."
model: ibm/granite-3-8b-instruct
pre_invoke_plugins:
- rbac_pre_invoke
instructions: |
You are an infrastructure recovery assistant with cluster administration rights.
tools:
- restart_kubernetes_podStep 4: Live Execution
orchestrate chat ask -n devops_remediation_agent "Restart production payment pod"╭─ 🚫 rbac_pre_invoke ───────────────────────────────────────────────────╮
│ │
│ 🚫 Access Denied (HTTP 403 Forbidden) │
│ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ │
│ User: guest@partner.com │
│ Required: admin, devops │
│ Assigned: viewer │
│ │
│ You do not possess the required security roles to interact. │
╰────────────────────────────────────────────────────────────────────────╯💡 Pro Tips & Architecture Insights
💡 continue_processing flag
Setting `continue_processing: False` completely bypasses model inference, saving token costs and completely eliminating prompt-injection attacks.
💡 Audit Logging
Combine pre-invoke RBAC with persistent audit logging to record unauthorized attempts.