# How to find harmful chains of allowed actions with Policy Lab with iFixAi

Repo: [ifixai-ai/iFixAi](https://github.com/ifixai-ai/iFixAi) | Difficulty: Advanced | Time: 1.5 hours | Basis: From the README

Use the offline Policy Lab to find the shortest harmful sequence of permitted actions and test permission fixes.

**Who it is for:** Security-minded engineer reviewing a refund or payout workflow where each step is allowed but the combination is not

**The problem:** Single permissions look fine, yet a chain of permitted actions can still cause harm.

**The outcome:** A shortest harmful sequence found offline, plus a check that your permission repair still allows legitimate work.

## Steps

1. Open the Policy Lab doc at docs/business-policy-lab.md in the repo
2. Follow its offline refund-store example
3. Adapt the example's policy and actions to your own workflow
4. Replay with an explicit local callable to confirm the repair holds

## Prompt to paste into your agent

```text
Read docs/business-policy-lab.md in ifixai-ai/iFixAi and run the offline refund-store example. Then adapt it to <my workflow>, report the shortest harmful sequence, and verify the proposed permission repair still allows the legitimate completion goal.
```

## Caveat

The README only introduces Policy Lab briefly, so details and commands live in docs/business-policy-lab.md and should be confirmed there.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/ifixai-ai-ifixai/find-harmful-action-sequences-policy-lab/