Python: Packages: add agent-framework-atr (ATR validation middleware provider) - #7062
Closed
Adam Lin (eeee2345) wants to merge 1 commit into
Closed
Python: Packages: add agent-framework-atr (ATR validation middleware provider)#7062Adam Lin (eeee2345) wants to merge 1 commit into
Adam Lin (eeee2345) wants to merge 1 commit into
Conversation
…provider) Packages the deterministic ATR validation middleware from the microsoft#6528 sample (python/samples/02-agents/middleware/atr_validation_middleware.py) as an installable agent-framework-atr package, mirroring the agent-framework-purview package structure. - ATRFunctionMiddleware blocks tool calls whose validated arguments match an ATR rule, at the tool-execution boundary (before call_next), per microsoft#5366. - ATRAgentMiddleware scans inbound user messages and blocks the run on a match. - ATRDetector is a shared wrapper over the local pyatr engine; detection is deterministic with no model call in the enforcement path. Wires the package into the uv workspace (tool.uv.sources + core [all] extra) and updates the lockfile. Adds README, LICENSE, and unit tests. Signed-off-by: eeee2345 <eeee2345@users.noreply.github.com>
Giles Odigwe (giles17)
added
documentation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new optional Python workspace package, agent-framework-atr, which integrates the local deterministic pyatr engine into Agent Framework middleware to block (or audit) ATR-matching user input and tool arguments.
Changes:
- Introduces the new
agent_framework_atrpackage withATRDetector,ATRFunctionMiddleware, andATRAgentMiddleware. - Adds unit tests, README, and package metadata (flit/uv/ruff/pyright/mypy configuration).
- Wires the package into the Python workspace and core’s
[all]extra, updatinguv.lock.
Reviewed changes
Copilot reviewed 9 out of 10 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| python/uv.lock | Adds workspace + lock entries for agent-framework-atr and pyatr. |
| python/pyproject.toml | Registers agent-framework-atr as a workspace member dependency. |
| python/packages/core/pyproject.toml | Adds agent-framework-atr to core’s all optional extra. |
| python/packages/atr/tests/atr/test_middleware.py | Adds unit tests covering block/allow and audit-only behavior. |
| python/packages/atr/README.md | Documents intended usage patterns and configuration for ATR middleware. |
| python/packages/atr/pyproject.toml | Defines the new distribution metadata and tooling configuration. |
| python/packages/atr/LICENSE | Adds MIT license file for the new package. |
| python/packages/atr/agent_framework_atr/_middleware.py | Implements agent + function middleware that call the detector and terminate on matches. |
| python/packages/atr/agent_framework_atr/_engine.py | Implements ATRDetector wrapper around pyatr and returns a structured detection. |
| python/packages/atr/agent_framework_atr/init.py | Exposes the public API surface via __all__. |
Comment on lines
+23
to
+25
| "Framework :: Pydantic :: 2", | ||
| "Typing :: Typed", | ||
| ] |
Comment on lines
+59
to
+66
| def __init__(self, *, rules_dir: str | None = None, min_severity: str = "informational") -> None: | ||
| engine: Any = pyatr.ATREngine() | ||
| if rules_dir is None: | ||
| engine.load_default_rules() | ||
| else: | ||
| engine.load_rules_from_directory(rules_dir) | ||
| self._engine: Any = engine | ||
| self._min_rank: int = _SEVERITY_ORDER.get(min_severity.lower(), 0) |
Contributor
|
I don't think this warrants a completely new package that we have to manage / support. |
Contributor
Author
|
Thanks Evan Mattson (@moonbox3) — that's fair, and I appreciate you weighing in. The deterministic ATR check is already available as the merged sample (#6528), so there's no need to add a separately maintained package on your side. I'll close this PR and the tracking issue (#7061). Thanks for the consideration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation & Context
PR #6528 (merged) added a sample showing deterministic validation at the tool-execution boundary (#5366), delegating detection to the open-source Agent Threat Rules (ATR) ruleset via the
pyatrengine. Today it is only a sample.This promotes that pattern to a first-class installable package,
agent-framework-atr, mirroring theagent-framework-purviewsecurity-middleware package, so it gets pip-installable distribution, IDE autocompletion, and docs. See #7061 for the proposal and open questions.Description & Review Guide
What are the major changes?
python/packages/atr/(agent_framework_atr):ATRFunctionMiddleware(FunctionMiddleware): blocks a tool call whose validated arguments match an ATR rule, beforecall_next()— so the tool never runs (the Add deterministic validation at execution boundary for agent actions #5366 pattern).ATRAgentMiddleware(AgentMiddleware): scans inbound user messages and blocks the run on a match.ATRDetector: a shared wrapper over the localpyatrengine; deterministic, no model call in the enforcement path. Both middleware supportaudit_only(shadow) mode and amin_severitythreshold.agent-framework-purview(pyproject with flit build, poe tasks, classifiers), plus README, LICENSE, and unit tests.agent-framework-atradded to[tool.uv.sources]and to core's[all]extra;uv.lockupdated. Depends onagent-framework-core+pyatr(MIT, pure-Python, only needs pyyaml which core already ships).What is the impact of these changes?
agent_framework_atrand it is intentionally not added toagent_framework.microsoft. This is one of the open questions in Python: Package the ATR validation middleware (#6528 sample) as an installable agent-framework-atr provider #7061 — happy to change it.What do you want reviewers to focus on?
ruff(format + lint) and the package unit tests pass locally (8 tests, 97% coverage) and the package builds with flit. Thepackage-checkspyright step reports the sameagent_framework-symbol-unknown diagnostics thatagent-framework-purviewalso produces locally when pyright reads the framework's lazy re-exports; that job is advisory (continue-on-error). Glad to adjust if you invoke pyright differently.Related Issue
Fixes #7061
Contribution Checklist