Python: Clarify identifier security guidance

[chetantoshniwal]

Summary

• clarify that AG-UI conversation identifiers provide continuity, not authorization
• document that A2A hosts must bind client-supplied identifiers to authenticated access boundaries
• document that Azure Functions HITL status/respond endpoints require authz and that workflow IDs are correlation handles only

Validation

• git diff --check

---

Created by Azure SRE Agent: Open thread on Saw | Open thread on MSFT

[Copilot]

Pull request overview

Clarifies security guidance across Agent Framework samples/docs to emphasize that client-supplied identifiers provide correlation/continuity, not authorization, and that hosts must enforce authentication/authorization at real access boundaries.

Changes:

• Azure Functions HITL sample: documents that workflow status/respond endpoints must be protected by authn/authz and that instanceId/requestId are correlation handles only.
• Python A2A package README: adds security considerations for production hosts, warning against treating task/thread/session identifiers as bearer credentials.
• .NET AG-UI sample README: clarifies ConversationId is for continuity only and points to session isolation (UseClaimsBasedSessionIsolation(...)) for multi-user storage separation.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
python/samples/04-hosting/azure_functions/12_workflow_hitl/README.md	Adds guidance to protect HITL status/respond endpoints and treat IDs as non-secret correlation handles.
python/packages/a2a/README.md	Adds security considerations for A2A hosting, emphasizing authn/authz and safe binding of client identifiers.
dotnet/samples/02-agents/AGUI/README.md	Adds AG-UI identifier security guidance and suggests claims-based session isolation for multi-user hosts.

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 86% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

---

Automated review by chetantoshniwal's agents

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	42563	5087	88%

report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
8339	37 💤	0 ❌	0 🔥	2m 12s ⏱️