[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

A private security review identified several cases where FIDES could lose or weaken information-flow state across transcript replay, MCP result retention, hidden argument validation, durable serialization, and invalid tool metadata. These gaps could cause policy decisions to use less restrictive integrity or confidentiality information than the data warranted.

This change hardens SecureAgentConfig and the FIDES middleware pipeline while preserving restored session state and approval-resume behavior. Context-provider message labeling remains separate follow-up work because context providers are trusted plugins with an existing documented trust boundary.

Description & Review Guide

• What are the major changes?
  • Reconstruct missing FIDES state from caller-replayed and history-provider messages, using conservative labels for unstamped assistant/tool data while keeping restored state authoritative.
  • Retain MCP _meta.ifc in an independently bounded security carrier so generic Host-payload budget exhaustion cannot discard the label; malformed or unretainable supplied IFC metadata fails closed.
  • Split hidden-argument handling into policy preflight and post-authorization materialization so expanded values do not reach Pydantic validators or tool bodies before policy permits the call.
  • Serialize opaque FIDES state with ASCII escapes so lone Unicode surrogates round-trip through JSON and MessagePack session stores.
  • Parse FIDES tool metadata centrally and block unknown or mistyped values with an auditable invalid_policy violation.
  • Add regression coverage across core and AG-UI approval/replay paths and update the FIDES guidance.
• What is the impact of these changes?
  • Transcript replay without persisted FIDES state now restores a conservative cumulative label instead of starting trusted/public.
  • Invalid security metadata that previously warned and continued now blocks execution.
  • Validators no longer run on expanded hidden values for calls rejected by FIDES.
  • Existing restored sessions and AG-UI approval resumes retain their authoritative state and behavior.
  • Non-history context-provider messages remain under the documented trusted-plugin model pending the follow-up design.
• What do you want reviewers to focus on?
  • The boundary between reconstructing missing replay state and preserving restored session state.
  • Approval binding and argument-materialization ordering, including validator transformations and runtime kwargs.
  • The independent MCP IFC carrier, its size bound, and fail-closed handling.

Related Issue

N/A - security hardening based on a privately reported issue. Per SECURITY.md, vulnerability details are not tracked in a public GitHub issue; maintainer direction was explicitly confirmed before implementation. The context-provider labeling follow-up is tracked separately in #9645 and is intentionally not closed by this PR. No competing open PR was found.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: GitHub Copilot assisted with the security assessment, implementation, regression tests, documentation updates, and PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-code-quality]

Code coverage overview

Languages: Python

Python / code-coverage/python

main b79c03c	fix-fides-security-h... 8b9c068	+/-
92%	92%	0%

View coverage of the 7 most impacted files.

File	main b79c03c	fix-fides-security-h... 8b9c068	+/-
packages/core/a...amework/_mcp.py	91%	90%	-1%
packages/core/a...ork/security.py	90%	90%	0%
packages/ag-ui/...i/_agent_run.py	90%	90%	0%
packages/core/a.../_middleware.py	96%	96%	0%
packages/core/a...ework/_tools.py	95%	95%	0%
packages/core/a...work/_agents.py	95%	95%	0%
packages/ag-ui/...age_adapters.py	93%	94%	+1%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 26, 2026 16:04 UTC}

[Copilot]

🟡 Changes recommended

Replay reconstruction can miss loaded history and lose identity-scoped restrictions, leaving downstream policy checks weaker than required.

3 open issues

• Propagate replay labels from nested function-result content · New
• Preserve replay restrictions when user identity principals are invalid · New
• Run history label reconstruction after persisted history loading · New

What changed in this PR

This PR hardens Python FIDES information-flow enforcement across transcript replay, MCP results, hidden arguments, and persisted session state. Non-history context-provider labeling remains a separate follow-up.

Changes:

• Reconstruct missing replay security state while preserving restored labels.
• Retain MCP security metadata independently and reject invalid tool policies.
• Defer hidden-value validation until authorization, support surrogate-safe serialization, and add regression tests and guidance.

File	Description
python/​samples/​02-agents/​security/​FIDES_DEVELOPER_GUIDE.md	Documents replay handling, metadata validation, and authorization ordering.
python/​packages/​core/​tests/​test_security.py	Adds policy, replay, serialization, and validator regressions.
python/​packages/​core/​tests/​core/​test_mcp.py	Tests security-label retention when payload budgets are exhausted.
python/​packages/​core/​agent_framework/​security.py	Implements replay reconstruction, policy parsing, and deferred argument materialization.
python/​packages/​core/​agent_framework/​_tools.py	Integrates deferred security argument materialization into invocation.
python/​packages/​core/​agent_framework/​_middleware.py	Tracks the active function middleware pipeline.
python/​packages/​core/​agent_framework/​_mcp.py	Adds an independently bounded security-metadata carrier.
docs/​features/​FIDES_IMPLEMENTATION_SUMMARY.md	Clarifies enforced flows and context-provider trust boundaries.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 634139edf460
Model: gpt-5.6-sol

Overview

The PR adds conservative replay reconstruction, independently bounded MCP IFC retention, delayed hidden-argument materialization, ASCII-safe durable state, and centralized tool-policy parsing. Its strongest guardrails are fail-closed MCP labeling, identity-bound argument materialization, unconditional ContextVar cleanup, and targeted regression coverage. Two gaps remain: restored sessions stop conservatively labeling newly supplied assistant/tool input, and explicit null enum policies bypass the new invalid-policy path.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (1 high, 1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/security.py

[Copilot]

🟡 Changes recommended

Authorization-ordering gaps remain, alongside hidden-MCP replay and argument-retry regressions.

4 open issues

• History loads after approved tools execute · New
• Wrapped policy middleware bypasses authorization before validation · New
• MCP metadata comparison rejects valid hidden placeholders · New
• Retry reuses stale materialization state · New

3 resolved since last review

• Run history label reconstruction after persisted history loading
• Preserve replay restrictions when user identity principals are invalid
• Propagate replay labels from nested function-result content

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unresolved confidentiality downgrades and synthetic-history tainting undermine the intended security and restored-session behavior.

2 open issues

• Replayed function calls incorrectly lose confidentiality state · New
• Oversized identity metadata weakens USER_IDENTITY confidentiality · New

1 previously missed issue

In code that hasn't changed since last review

Synthetic skipped tool results incorrectly taint restored sessions

python/​packages/​ag-ui/​agent_framework_ag_ui/​_agent_run.py:3223

When a user abandons an unanswered client-tool call from the backend snapshot, normalization inserts a framework-generated “Tool execution skipped” result without snapshot provenance. FIDES treats that synthetic result as new UNTRUSTED/PRIVATE data, tainting the restored session and blocking unrelated protected tools. Preserve trusted provenance for synthetic results derived from backend-owned calls without trusting actual client-supplied results, and add an abandoned-call continuation regression with FIDES enabled.

4 resolved since last review

• Wrapped policy middleware bypasses authorization before validation
• History loads after approved tools execute
• Retry reuses stale materialization state
• MCP metadata comparison rejects valid hidden placeholders

_{Review effort: Balanced}

[Eduard van Valkenburg (eavanvalkenburg)]

Addressed the current-head Copilot review’s previously missed synthetic skipped-result issue in 4b3fd9660. AG-UI now propagates backend-snapshot provenance only to framework-generated skipped results derived from backend-owned calls; real client tool results remain untrusted. Added an abandoned-call continuation regression with FIDES enabled.

[Copilot]

🔵 Needs a closer look

Cross-cutting security-boundary changes and unresolved label-handling defects require fixes and final security-focused human review.

1 open issue

• Prevent principal inheritance on MCP failure labels · New

1 previously missed issue

In code that hasn't changed since last review

Exclude unchanged authenticated placeholders from integrity fallback

python/​packages/​core/​agent_framework/​security.py:1147

Replaying an unchanged, authenticated hidden result as ordinary caller input still applies the UNTRUSTED fallback, even with restored session state. This taints an otherwise clean session and blocks unrelated protected tools although the payload remains hidden. Exempt authenticated-placeholder-only messages from the integrity fallback, retain conservative handling for modified or visible data, and add a caller-input regression.

2 resolved since last review

• Oversized identity metadata weakens USER_IDENTITY confidentiality
• Replayed function calls incorrectly lose confidentiality state

_{Review effort: Balanced}

[Eduard van Valkenburg (eavanvalkenburg)]

Addressed the latest Copilot review’s previously missed authenticated-placeholder caller-input issue in a08f596e4. Replay reconstruction now skips the UNTRUSTED fallback only when the message contains authenticated session-owned hidden placeholders and no visible data; modified placeholders and visible/function-call content remain conservative. Added a caller-input regression that preserves TRUSTED/PRIVATE and allows an unrelated protected action.

[Copilot]

🟡 Changes recommended

Confirmation-only resumes can persist TRUSTED/PUBLIC without reconstructing snapshot history when FIDES state is missing.

1 open issue

• Reconstruct history when snapshot context label is missing · New

2 resolved since last review

• Prevent duplicate-key injection from bypassing placeholder authentication
• Process fresh client-tool results before confirm_changes snapshot return

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Hidden values can reach validators before a later policy enforcer rejects the invocation, leaving an unresolved security boundary violation.

1 open issue

• Defer protected-value materialization until all policies authorize · New

1 resolved since last review

• Reconstruct history when snapshot context label is missing

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Unresolved security findings require correction, and the cross-cutting replay and authorization changes warrant final human review.

2 open issues

• Prevent stale labels on pre-run client-result snapshots · New
• Bind references and labels to materialization tokens · New

1 resolved since last review

• Defer protected-value materialization until all policies authorize

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unresolved argument-authority checks allow post-authorization mutations to escape enforcement.

2 open issues

• Runtime kwarg mutations bypass approval binding · New
• Termination bypasses authority check for mutated arguments · New

2 resolved since last review

• Bind references and labels to materialization tokens
• Prevent stale labels on pre-run client-result snapshots

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Unresolved security findings and changes across policy, replay, and approval boundaries require fixes and final human security review.

2 open issues

• Prevent trusted replay of placeholders containing untrusted metadata · New
• Bind approval tokens to normalized runtime session identity · New

2 resolved since last review

• Termination bypasses authority check for mutated arguments
• Runtime kwarg mutations bypass approval binding

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Cross-package security-state and approval-lifecycle changes require final maintainer security review and confirmation of core and AG-UI regression validation.

No open issues 🎉

2 resolved since last review

• Bind approval tokens to normalized runtime session identity
• Prevent trusted replay of placeholders containing untrusted metadata

_{Review effort: Balanced}