# rewanthtammana/who-let-the-agents-act architecture

> Architecture diagram of the GitHub repository rewanthtammana/who-let-the-agents-act, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/rewanthtammana/who-let-the-agents-act
- Repository: https://github.com/rewanthtammana/who-let-the-agents-act

## Overview

Who Let the Agents Act is a web-based educational lab for comparing vulnerable, prompt-only, and hardened AI-agent security designs. A user selects a scenario and mode, submits a prompt, and inspects the resulting plan, policy decisions, tool and database activity, and outcome. The nine labs cover distinct authorization, privacy, injection, retrieval, approval, and agent-handoff failures. The graph combines README-documented behavior with sampled files; API routing and most scenario internals were not sampled, so those connections are limited to documented workflow.

Main entry points: [`scenarios/registry.py`](https://github.com/rewanthtammana/who-let-the-agents-act/blob/main/scenarios/registry.py) (Scenario registry), [`core/langchain_agent.py`](https://github.com/rewanthtammana/who-let-the-agents-act/blob/main/core/langchain_agent.py) (Agent adapter), [`scenarios`](https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios) (Scenario databases), [`app.py`](https://github.com/rewanthtammana/who-let-the-agents-act/blob/main/app.py) (Web application)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_web["Web experience"]
  node_frontend["Lab interface<br/>[app.js]"]
  node_backend["Web application<br/>[app.py]"]
end

subgraph group_runtime["Shared runtime"]
  node_catalog["Scenario registry<br/>[registry.py]"]
  node_agent_runtime["Agent adapter<br/>[langchain_agent.py]"]
end

subgraph group_labs["Security labs"]
  node_overpowered["Excessive data access"]
  node_cross_account["Cross-account access"]
  node_handoff["Unsafe agent handoff"]
  node_refund["Refund rule bypass"]
  node_injection["Invoice injection"]
  node_rag["Tenant RAG leakage"]
  node_debug["Debug secret leakage"]
  node_approval["Approval outage"]
  node_deputy["Confused deputy"]
end

subgraph group_state["Scenario state"]
  node_scenario_state[("Scenario databases")]
  node_trace["Run trace"]
end

node_user(("Lab user"))
node_model["Groq model"]

node_user -->|"submits prompt"| node_frontend
node_frontend -->|"sends run"| node_backend
node_backend -->|"selects scenario"| node_catalog
node_backend -->|"returns result"| node_frontend
node_catalog -->|"dispatches"| node_overpowered
node_catalog -->|"dispatches"| node_cross_account
node_catalog -->|"dispatches"| node_handoff
node_catalog -->|"dispatches"| node_refund
node_catalog -->|"dispatches"| node_injection
node_catalog -->|"dispatches"| node_rag
node_catalog -->|"dispatches"| node_debug
node_catalog -->|"dispatches"| node_approval
node_catalog -->|"dispatches"| node_deputy
node_overpowered -->|"requests model"| node_agent_runtime
node_cross_account -->|"requests model"| node_agent_runtime
node_handoff -->|"requests model"| node_agent_runtime
node_refund -->|"requests model"| node_agent_runtime
node_injection -->|"requests model"| node_agent_runtime
node_rag -->|"requests model"| node_agent_runtime
node_debug -->|"requests model"| node_agent_runtime
node_approval -->|"requests model"| node_agent_runtime
node_deputy -->|"requests model"| node_agent_runtime
node_agent_runtime -->|"invokes"| node_model
node_overpowered -->|"reads and writes"| node_scenario_state
node_cross_account -->|"reads and writes"| node_scenario_state
node_handoff -->|"reads and writes"| node_scenario_state
node_refund -->|"reads and writes"| node_scenario_state
node_injection -->|"reads and writes"| node_scenario_state
node_rag -->|"reads and writes"| node_scenario_state
node_approval -->|"reads and writes"| node_scenario_state
node_deputy -->|"reads and writes"| node_scenario_state
node_scenario_state -->|"records activity"| node_trace

click node_frontend "https://github.com/rewanthtammana/who-let-the-agents-act/blob/main/static/app.js"
click node_backend "https://github.com/rewanthtammana/who-let-the-agents-act/blob/main/app.py"
click node_catalog "https://github.com/rewanthtammana/who-let-the-agents-act/blob/main/scenarios/registry.py"
click node_agent_runtime "https://github.com/rewanthtammana/who-let-the-agents-act/blob/main/core/langchain_agent.py"
click node_overpowered "https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/overpowered_data_tool"
click node_cross_account "https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/cross_customer_access"
click node_handoff "https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/signed_handoff"
click node_refund "https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/business_rule"
click node_injection "https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/indirect_injection"
click node_rag "https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/rag_tenant_isolation"
click node_debug "https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios"
click node_approval "https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/approval_service_outage"
click node_deputy "https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/multi_agent_confused_deputy"
click node_scenario_state "https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios"
click node_trace "https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_frontend,node_backend,node_user toneBlue
class node_catalog,node_agent_runtime toneAmber
class node_overpowered,node_cross_account,node_handoff,node_refund,node_injection,node_rag,node_debug,node_approval,node_deputy toneMint
class node_scenario_state,node_trace toneRose
class node_model toneIndigo
```

## Components

### Web experience

- [Lab interface](https://github.com/rewanthtammana/who-let-the-agents-act/blob/main/static/app.js): `static/app.js`
- [Web application](https://github.com/rewanthtammana/who-let-the-agents-act/blob/main/app.py): `app.py`

### Shared runtime

- [Scenario registry](https://github.com/rewanthtammana/who-let-the-agents-act/blob/main/scenarios/registry.py): `scenarios/registry.py`
- [Agent adapter](https://github.com/rewanthtammana/who-let-the-agents-act/blob/main/core/langchain_agent.py): `core/langchain_agent.py`

### Security labs

- [Excessive data access](https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/overpowered_data_tool): `scenarios/overpowered_data_tool`
- [Cross-account access](https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/cross_customer_access): `scenarios/cross_customer_access`
- [Unsafe agent handoff](https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/signed_handoff): `scenarios/signed_handoff`
- [Refund rule bypass](https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/business_rule): `scenarios/business_rule`
- [Invoice injection](https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/indirect_injection): `scenarios/indirect_injection`
- [Tenant RAG leakage](https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/rag_tenant_isolation): `scenarios/rag_tenant_isolation`
- [Debug secret leakage](https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios): `scenarios`
- [Approval outage](https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/approval_service_outage): `scenarios/approval_service_outage`
- [Confused deputy](https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios/multi_agent_confused_deputy): `scenarios/multi_agent_confused_deputy`

### Scenario state

- [Scenario databases](https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios): `scenarios`
- [Run trace](https://github.com/rewanthtammana/who-let-the-agents-act/tree/main/scenarios): `scenarios`

### Other components

- **Lab user**
- **Groq model**

## Connections

- Lab user → Lab interface: submits prompt
- Lab interface → Web application: sends run
- Web application → Scenario registry: selects scenario
- Web application → Lab interface: returns result
- Scenario registry → Excessive data access: dispatches
- Scenario registry → Cross-account access: dispatches
- Scenario registry → Unsafe agent handoff: dispatches
- Scenario registry → Refund rule bypass: dispatches
- Scenario registry → Invoice injection: dispatches
- Scenario registry → Tenant RAG leakage: dispatches
- Scenario registry → Debug secret leakage: dispatches
- Scenario registry → Approval outage: dispatches
- Scenario registry → Confused deputy: dispatches
- Excessive data access → Agent adapter: requests model
- Cross-account access → Agent adapter: requests model
- Unsafe agent handoff → Agent adapter: requests model
- Refund rule bypass → Agent adapter: requests model
- Invoice injection → Agent adapter: requests model
- Tenant RAG leakage → Agent adapter: requests model
- Debug secret leakage → Agent adapter: requests model
- Approval outage → Agent adapter: requests model
- Confused deputy → Agent adapter: requests model
- Agent adapter → Groq model: invokes
- Excessive data access → Scenario databases: reads and writes
- Cross-account access → Scenario databases: reads and writes
- Unsafe agent handoff → Scenario databases: reads and writes
- Refund rule bypass → Scenario databases: reads and writes
- Invoice injection → Scenario databases: reads and writes
- Tenant RAG leakage → Scenario databases: reads and writes
- Approval outage → Scenario databases: reads and writes
- Confused deputy → Scenario databases: reads and writes
- Scenario databases → Run trace: records activity