Function Access Control

Function Access Control lets you define fine-grained permissions for individual functions, controlling who can call what and under what conditions.

What is Function Access Control?

Function Access Control allows you to:

Define which roles can call which functions
Set function-specific security rules
Configure function-level analysis settings
Define output restrictions

Configuring Function Access

Via UI

Navigate to Policies → Select a policy
Go to Functions tab
Add or edit function configurations
Set permissions and rules

Function access configuration is currently available through the Hipocap web UI. Python SDK methods for function configuration are not yet available.

Function Configuration Options

Allowed Roles

Specify which roles can call this function:

{
  "functions": {
    "send_email": {
      "allowed_roles": ["admin", "user"]
    }
  }
}

Blocked Roles

Explicitly block certain roles:

{
  "functions": {
    "delete_email": {
      "blocked_roles": ["guest", "user"]
    }
  }
}

Require Quarantine

Force quarantine analysis for this function:

{
  "functions": {
    "send_email": {
      "require_quarantine": true
    }
  }
}

Keyword Detection

Enable keyword detection for this function:

{
  "functions": {
    "process_document": {
      "enable_keyword_detection": true,
      "keywords": ["confidential", "classified"]
    }
  }
}

Output Restrictions

Restrict what can be returned from this function:

{
  "functions": {
    "get_user_data": {
      "output_restrictions": {
        "block_sensitive_keywords": true,
        "max_length": 1000,
        "allowed_formats": ["text", "json"]
      }
    }
  }
}

Severity Rules per Function

Define function-specific severity handling:

{
  "functions": {
    "send_email": {
      "severity_rules": {
        "critical": {
          "action": "BLOCK",
          "threshold": 0.9
        },
        "high": {
          "action": "BLOCK",
          "threshold": 0.7
        },
        "medium": {
          "action": "BLOCK",
          "threshold": 0.5
        }
      }
    }
  }
}

Function-Level Analysis Configuration

Configure analysis stages per function:

{
  "functions": {
    "critical_function": {
      "input_analysis": true,
      "llm_analysis": true,
      "quarantine_analysis": true,
      "quick_analysis": false
    },
    "standard_function": {
      "input_analysis": true,
      "llm_analysis": false,
      "quarantine_analysis": false,
      "quick_analysis": true
    }
  }
}

Wildcard Functions

Use wildcards to apply rules to multiple functions:

{
  "functions": {
    "email_*": {  // Matches send_email, read_email, etc.
      "allowed_roles": ["admin", "user"],
      "require_quarantine": true
    },
    "*_admin": {  // Matches any function ending in _admin
      "allowed_roles": ["admin"]
    }
  }
}

Function Metadata

Add metadata to functions for better organization:

{
  "functions": {
    "send_email": {
      "name": "Send Email",
      "description": "Sends an email to the specified recipient",
      "category": "communication",
      "risk_level": "high",
      "allowed_roles": ["admin", "user"]
    }
  }
}

Example: Complete Function Configuration

{
  "functions": {
    "send_email": {
      "allowed_roles": ["admin", "user"],
      "blocked_roles": ["guest"],
      "require_quarantine": true,
      "enable_keyword_detection": true,
      "keywords": ["confidential", "password reset"],
      "input_analysis": true,
      "llm_analysis": true,
      "quarantine_analysis": true,
      "quick_analysis": false,
      "severity_rules": {
        "critical": {
          "action": "BLOCK",
          "threshold": 0.9
        },
        "high": {
          "action": "BLOCK",
          "threshold": 0.7
        }
      },
      "output_restrictions": {
        "block_sensitive_keywords": true
      }
    }
  }
}

Checking Function Access

Hipocap automatically checks function access when analyzing:

from hipocap import Hipocap

client = Hipocap.hipocap_client

result = client.analyze(
    function_name="send_email",
    user_role="user",
    function_result=email_content
)

if result.get("rbac_blocked"):
    # User role doesn't have permission
    raise PermissionError("Access denied")

Best Practices

Start Restrictive - Begin with restrictive permissions, then open up as needed
Function-Specific Rules - Configure rules per function based on risk level
Regular Reviews - Review function access regularly
Documentation - Document why each function has specific rules
Testing - Test function access with different roles

Next Steps

Roles & Permissions - Set up RBAC
Function Chaining - Control function chains
Policies - Manage policies

Introduction

AI Security

Governance & RBAC

Observability

What is Function Access Control?

Configuring Function Access

Via UI

Function Configuration Options

Allowed Roles

Blocked Roles

Require Quarantine

Keyword Detection

Output Restrictions

Severity Rules per Function

Function-Level Analysis Configuration

Wildcard Functions

Function Metadata

Example: Complete Function Configuration

Checking Function Access

Best Practices

Next Steps

​What is Function Access Control?

​Configuring Function Access

​Via UI

​Function Configuration Options

​Allowed Roles

​Blocked Roles

​Require Quarantine

​Keyword Detection

​Output Restrictions

​Severity Rules per Function

​Function-Level Analysis Configuration

​Wildcard Functions

​Function Metadata

​Example: Complete Function Configuration

​Checking Function Access

​Best Practices

​Next Steps

What is Function Access Control?

Configuring Function Access

Via UI

Function Configuration Options

Allowed Roles

Blocked Roles

Require Quarantine

Keyword Detection

Output Restrictions

Severity Rules per Function

Function-Level Analysis Configuration

Wildcard Functions

Function Metadata

Example: Complete Function Configuration

Checking Function Access

Best Practices

Next Steps