Skip to content

Add governance policy block lists #1252

Closed
Closed
Add governance policy block lists#1252
Assignees
Bionic711
Labels
enhancementNew feature or requestsecurity_improvementThis issue results in an improvement to security

Description

@Bionic711
Bionic711
opened on Aug 15, 2026

Summary

Add governance policy block lists so admins can explicitly deny users or groups from governed features and delegated resources, even when allow-all or an allow list would otherwise grant access.

User Value

Customers with APIM-backed endpoint quota tiers need an administrator-friendly way to keep high-threshold users away from low-threshold endpoints, and vice versa, without maintaining large allow lists as ordinary users are onboarded.

Proposed Behavior

  • Add denied_users and denied_groups to feature and delegated item governance policies.
  • Evaluate block lists before allow-all, allowed_users, and allowed_groups.
  • Preserve existing feature-gate behavior: item policies cannot grant access to a feature the user is blocked from using.
  • Expose block-list management in Admin Settings alongside existing allow-list controls.
  • Keep duplicated governance paths, including MCP source/destination policy handling, aligned with deny-overrides-allow semantics.

Acceptance Criteria

  • Admins can configure blocked users and groups for feature policies.
  • Admins can configure blocked users and groups for delegated item policies.
  • A matching block-list entry denies access even when allow-all or an allow-list entry would grant it.
  • Endpoint quota-class separation can be modeled with one high endpoint allow list and one low endpoint block list.
  • Functional/UI coverage validates backend enforcement, admin payloads, activity logging diffs, and MCP governance paths.

Notes

Implementation is in progress on branch feature/governance-options-plan and app version 0.250.204.

Activity

  1. Bionic711
    self-assigned this
    on Aug 15, 2026
  2. Bionic711
    added
    enhancementNew feature or request
    security_improvementThis issue results in an improvement to security
    on Aug 15, 2026
  3. github-project-automation
    moved this to Pending Evaluation in Simple Chat Roadmapon Aug 15, 2026
  4. github-project-automation
    added this to Simple Chat Roadmapon Aug 15, 2026
  5. Bionic711
    moved this from Pending Evaluation to Pending Assignment in Simple Chat Roadmapon Aug 15, 2026

  6. Bionic711 commented on Aug 15, 2026

    @Bionic711
    Bionic711
    on Aug 15, 2026
    CollaboratorAuthor

    Implementation completed locally on feature/governance-options-plan for app version 0.250.204.

    Summary:

    • Added denied_users and denied_groups to feature and delegated item governance policies.
    • Enforced deny-overrides-allow semantics across standard governance checks, global/action-type paths, inbound MCP source governance, and outbound MCP destination governance.
    • Added Admin Settings UI/API support for managing allow lists plus block lists.
    • Added release notes entry under v0.250.204.

    Validation completed:

    • python -m py_compile for changed Python files
    • node --check application\single_app\static\js\admin\admin_governance.js
    • python functional_tests\test_governance_enforcement_logic.py
    • python functional_tests\test_governance_activity_logging.py
    • python functional_tests\test_governance_route_and_wiring_coverage.py
    • python functional_tests\test_inbound_mcp_governance_and_tools.py
    • python functional_tests\test_mcp_destination_governance_and_preconfigurations.py
    • python -m pytest ui_tests\test_admin_governance_tab.py -q (skipped in this local environment)
    • Broken Access Control guardrail on changed backend files
    • Diff-only XSS added-line scan on changed frontend files
    • git diff --check

  7. Bionic711 commented on Aug 15, 2026

    @Bionic711
    Bionic711
    on Aug 15, 2026
    CollaboratorAuthor

    Follow-up completed for the delegated item block-list modal behavior.

    Summary:

    • Fixed the double-modal issue by hiding the item policy editor before opening the shared principal editor.
    • The item policy editor is restored after the principal editor closes, so Bootstrap only has one governance modal visible at a time.
    • Bumped app version to 0.250.205 and added a v0.250.205 release note entry.

    Validation completed:

    • python -m py_compile application\single_app\config.py functional_tests\test_governance_route_and_wiring_coverage.py ui_tests\test_admin_governance_tab.py
    • node --check application\single_app\static\js\admin\admin_governance.js
    • python functional_tests\test_governance_route_and_wiring_coverage.py
    • python -m pytest ui_tests\test_admin_governance_tab.py -q (skipped in this local environment)
    • Diff-only XSS added-line scan
    • git diff --check

  8. Bionic711 commented on Aug 15, 2026

    @Bionic711
    Bionic711
    on Aug 15, 2026
    CollaboratorAuthor

    Implemented the delegated item policy retargeting fix for the governance block-list work.

    What changed:

    • Existing delegated item policy edits now lock the entity/item target controls in the admin UI.
    • The frontend includes original target metadata and refuses stale saves if the original policy identity changes unexpectedly.
    • The backend now rejects attempts to reuse an existing item policy ID for a different delegated item, preventing duplicate policy documents.
    • Release notes were updated for v0.250.206.

    Validation:

    • node --check application\single_app\static\js\admin\admin_governance.js
    • python -m py_compile for the changed Python and test files
    • python functional_tests\test_governance_enforcement_logic.py
    • python functional_tests\test_governance_route_and_wiring_coverage.py
    • python -m pytest ui_tests\test_admin_governance_tab.py -q (skipped locally because the UI test environment is not configured)
    • XSS changed-line guardrail
    • Broken Access Control changed-line guardrail
    • git diff --check

    Follow-up note: any duplicate policy already created in a deployed environment still needs to be removed manually through the admin UI or with an explicitly approved data cleanup.

  9. Bionic711 commented on Aug 15, 2026

    @Bionic711
    Bionic711
    on Aug 15, 2026
    CollaboratorAuthor

    Follow-up implemented for intentional delegated item policy retargeting.

    What changed after the initial duplicate-prevention fix:

    • Existing delegated item policy edits can now intentionally change the entity/item target while keeping the same policy ID.
    • The admin UI warns that changing the target will move the policy, keeps the policy ID stable, and sends original target metadata with the save request.
    • The backend treats that original target metadata as an explicit move: it upserts the new target policy and deletes the old source policy document.
    • Ambiguous policy-ID reuse without matching original target metadata is still rejected to prevent accidental duplicates.
    • Feature-policy saves and item-policy deletes were kept out of the retarget conflict path.
    • Source lookup now requires the exact named policy ID so retarget/delete operations do not fall back to a default policy by mistake.
    • Release notes were updated for v0.250.207.

    Validation:

    • node --check application\single_app\static\js\admin\admin_governance.js
    • python -m py_compile for the changed Python and test files
    • python functional_tests\test_governance_enforcement_logic.py
    • python functional_tests\test_governance_route_and_wiring_coverage.py
    • Route policy trio
    • python -m pytest ui_tests\test_admin_governance_tab.py -q (skipped locally because the UI test environment is not configured)
    • XSS changed-line guardrail
    • Broken Access Control changed-line guardrail
    • git diff --check

    No production data was changed.

  10. Bionic711 commented on Aug 15, 2026

    @Bionic711
    Bionic711
    on Aug 15, 2026
    CollaboratorAuthor

    Implemented the delegated governance policy action follow-up for v0.250.208.

    Summary:

    • Added row-level Show Users, Duplicate, and Inverse actions for delegated item policies.
    • Duplicate opens the existing item policy editor in create mode with the same target/access lists, (duplicate) appended to the name, and a blank policy ID so save creates a new policy.
    • Inverse opens create mode with (inverse) appended, preserves Allow All, and swaps allowed users/groups with blocked users/groups.
    • Moved allowed/blocked user/group details out of the main delegated policy table into a read-only Show Users modal.
    • Added release notes under v0.250.208.

    Validation:

    • node --check application\single_app\static\js\admin\admin_governance.js
    • python -m py_compile application\single_app\config.py functional_tests\test_governance_route_and_wiring_coverage.py ui_tests\test_admin_governance_tab.py
    • python functional_tests\test_governance_route_and_wiring_coverage.py
    • python -m pytest ui_tests\test_admin_governance_tab.py -q (skipped locally because UI env vars/storage state were not configured)
    • Broken Access Control guardrail passed for changed Python files
    • XSS guardrail passed for changed governance JS
    • git diff --check

    Note: Running the XSS guardrail against all of admin_settings.html still reports unrelated legacy markdown preview sinks outside this governance table header change.

  11. paullizer commented on Aug 19, 2026

    @paullizer
    Paul Lizer (paullizer)
    on Aug 19, 2026
    Collaborator

    Shipped in v0.250.208 via #1253.

    Release note entries:

    • v0.250.208: Governance Policy Copy and Principal Review Actions
    • v0.250.207: Intentional Governance Item Policy Retargeting
    • v0.250.206: Governance Item Policy Retarget Protection
    • v0.250.205: Governance Block List Modal Handoff
    • v0.250.204: Governance Policy Block Lists

    Full notes: https://microsoft.github.io/simplechat/explanation/release_notes/

    Closing as completed. This issue stayed open after the fix merged because pull requests target Development while the repository default branch is main, so GitHub never applied the Fixes # keyword automatically.

  12. Paul Lizer (paullizer)
    closed this as completedon Aug 19, 2026
  13. github-project-automation
    moved this from Pending Assignment to Released in Simple Chat Roadmapon Aug 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

enhancementNew feature or requestsecurity_improvementThis issue results in an improvement to security

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions