.Net: New Feature: Ingerating .Net authorization with tool calling

[maghawry74]

Code Example
public class TimeTool
{
[KernelFunction, Description("Provides the current date and time.")]
[Authorize] // only sends this tool when the user is authenticated
public static string GetTime() => DateTime.UtcNow.ToString("R", CultureInfo.InvariantCulture);
}

and so on.

[sphenry]

@SergeyMenshykh What are doing at the moment for authorization? Is this relevant to non-asp.net applications?

[SergeyMenshykh]

Authentication and authorization of tools/functions have been outside the scope of SK, except for OpenAPI functions, where SK can accept a custom HTTP handler to enable authentication scenarios.

There have been conversations about filters for function advertisements that would allow customization of the process for providing/sending functions to AI models, but we are not there yet.

Meanwhile, you can consider a few options:

1. Always import plugins available to everyone and import plugins requiring authorization only if the current user is authenticated and authorized:

   var builder = Kernel.CreateBuilder();
   
   var kernel = builder.Build();
   kernel.ImportPluginFromType<RestrictedFunctions>("OpenAccessFunctions");
   
   // Check if the current user has access to the system
   if (this.CheckCurrentUserAuthorized())
   {
       kernel.ImportPluginFromType<RestrictedFunctions>("RestrictedFunctions");
   }
   
   OpenAIPromptExecutionSettings settings = new() { FunctionChoiceBehavior = FunctionChoiceBehavior.Auto() };
   
   Console.WriteLine(await kernel.InvokePromptAsync("<Your prompt>", new(settings)));

2. Another flavor of Option 1 that does not import plugins to kernel and supply them just before sending the prompt:

   var builder = Kernel.CreateBuilder();
   builder.AddOpenAIChatCompletion(TestConfiguration.OpenAI.ChatModelId, TestConfiguration.OpenAI.ApiKey);
   
   var kernel = builder.Build();
   
   IEnumerable<KernelFunction> openAccessFunctions = kernel.CreatePluginFromType<OpenAccessFunctions>("OpenAccessFunctions");
   
   IEnumerable<KernelFunction> restrictedFunctions = kernel.CreatePluginFromType<RestrictedFunctions>("RestrictedFunctions");
   
   IEnumerable<KernelFunction> functions= this.CheckCurrentUserAuthorized() ? openAccessFunctions : openAccessFunctions.Concat(restrictedFunctions);
   
   OpenAIPromptExecutionSettings settings = new() { FunctionChoiceBehavior = FunctionChoiceBehavior.Auto(functions) };
   
   Console.WriteLine(await kernel.InvokePromptAsync("<Your prompt>", new(settings)));

Option 1 will require re-creating the kernel and importing plugins every time the user authentication/authorization status changes, while with Option 2, it's not necessary since the functions are not imported to the kernel.