Python: Tighten security label enforcement

[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Security labels and identity-scoped data must preserve locally established trust and ownership boundaries across tool results, approvals, sessions, and remote content conversion.

Description & Review Guide

• What are the major changes? Make embedded labels restriction-only unless stamped by a framework-owned producer, bind USER_IDENTITY flows and approvals to canonical tenant/user principals, bound transitive variable expansion with cycle detection, and add a runnable user_identity_security_example.py showing authenticated principal setup with allowed and blocked destinations.
• What is the impact of these changes? Malformed or mismatched identity metadata fails closed while existing PUBLIC and PRIVATE ranking remains unchanged. The security README and developer guide now document canonical principal metadata and restriction-only mixed-trust labeling. Full core, hosting-A2A, sample lint/type, and markdown code checks pass.
• What do you want reviewers to focus on? Label authority boundaries, principal propagation and approval binding, bounded variable expansion, and whether the new sample clearly demonstrates host-authenticated principal configuration.

Related Issue

No related open issue.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

Public API validation, sensitive metadata logging, and approval-resume integration coverage need correction.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Tightens Python security-label authority, identity-principal enforcement, approval binding, and variable expansion limits.

Changes:

• Restricts embedded labels unless framework-authoritative.
• Enforces canonical tenant/user principals across flows and approvals.
• Adds bounded transitive variable expansion and security regressions.

File summaries

File	Description
python/packages/core/agent_framework/security.py	Implements security enforcement changes.
python/packages/core/tests/test_security.py	Adds principal, approval, label, expansion, and isolation tests.
python/packages/hosting-a2a/tests/hosting_a2a/test_conversion.py	Verifies remote A2A metadata cannot upgrade integrity.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): f183929bf5e1
Model: gpt-5.6-sol-fast

Overview

The change establishes strong authority boundaries through process-local label stamps, canonical tenant/user principal sets, principal-bound approval records, and bounded transitive variable expansion. Tests cover forged labels, principal drift, cross-session isolation, malformed principal state, cycles, and traversal limits. Two Medium compatibility gaps remain: the new public helper does not honor its advertised input types, and existing documented USER_IDENTITY configurations are blocked without corresponding migration guidance.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/security.py