Ask for M365 Run as approval only when someone else authored the revision

[Paul Lizer (paullizer)]

Summary

• Run as approval only when someone else authored the revision. A Microsoft 365 workflow revision saved by its own Run as user now runs as them without a separate approval, including on its first run. That holds when modified_by equals m365_run_as_user_id, which equals the run's data user, and nobody else changed an agent or action it uses after that save. ensure_workflow_binding then records an approved binding marked self_authored: true for that exact revision, connection id and generation. It writes an append-only self_authored_approved audit event, sends no notification and is never pending. A revision someone else saved, a missing modified_by, or a later edit by someone else still asks. A new connection id or generation also asks again on someone else's revision.
• Audience changes never ask again. ensure_workflow_binding and validate_workflow_binding stop comparing audience_version, though the binding still records it. Source-sharing approvals are unchanged, and so are the runtime audience checks that guard runs and deliveries already in progress.
• Explicit decisions still win. A denial or cancellation recorded for a run still blocks that run (m365_workflow_declined). Revoking a binding in Profile revokes every approved copy of that revision. The revision is never self-authored again and falls back to a normal pending approval. A revocation stays in force when it races a run or is interrupted. A revocation made before this release still withdraws only its own binding, so other approvals keep working.
• Authorship integrity and UI text. Every save path takes modified_by from the authenticated actor. The one gap was raw Data Management Cosmos DB editor edits of workflows, agents and actions, which now record the administrator. The V2 proposal card follows the backend's new approval_state: self_authored. The editor's "Saving requires re-approving Run as" note, the AI assistant's run_as_reapproval warning, the Run as help text and the classic Profile and Approvals labels follow the same rule.

Linked issue

Refs #1621

This is the Run as part of #1621. It is independent of the content-screening PR stack (#1628 and later) and touches no content screening code.

Version note: this PR and #1628 both claim 0.261.229. Whichever merges second renumbers its version: config.py, the release notes header, the test Version: headers and assert_app_version_at_least, and the feature doc.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

VERSION moves from 0.261.228 to 0.261.229. Nothing under deployers/ changed.

Testing / validation

python is a venv overlay on the system site packages with cryptography 46.0.7, Flask 3.1.3, Werkzeug 3.1.6 and Flask-Session 0.8.0. The global environment can't collect these tests. Baselines were recorded on fd842e199 before any edit.

• python -m pytest functional_tests/test_m365_run_as_self_authored.py -q → 51 passed. python -O -m pytest functional_tests/test_m365_run_as_self_authored.py -q → 51 passed.
• The new tests fail without the fix:
  • The first 43, with functions_m365_approvals.py, functions_m365_execution.py, functions_m365_runtime.py and functions_data_management.py reverted to base → 15 failed, 28 passed.
  • The 4 revocation race tests, against the first commit's functions_m365_approvals.py → 4 failed.
  • The 5 pre-release revocation tests, against the second commit's → 5 failed.
• The functional suite is the 62 test files covering the changed areas, plus the new file, test_group_collaboration_source_storage_fix.py and test_mcp_authorization_context.py, run with python -m pytest <files> -q -rfE. No new failures.
  • Baseline: 24 failed, 1797 passed. Final 1284fdfaf: 28 failed, 1899 passed, which is 24 failed test IDs plus 4 SUBFAILED subtests.
  • 23 of the 24 IDs are baseline failures: stale harnesses, the capture_execution_identity NameError, and tests that need Azure configuration.
  • The 24th is a test_m365_runtime_imports.py cold-import probe that hit its 90s subprocess timeout under load. Rerun alone, python -m pytest "functional_tests/test_m365_runtime_imports.py::test_web_scheduler_modules_import_without_reversed_bootstrap_or_network[functions_m365_execution-True]" -q → 1 passed. A baseline timeout in the same family no longer fails.
  • The 4 subtests fail the same way on base fd842e199: python -m pytest functional_tests/test_group_collaboration_source_storage_fix.py functional_tests/test_mcp_authorization_context.py -q in a base worktree → 4 failed, 49 passed.
  • One earlier loaded run hit the 300s and 150s subprocess timeouts in test_orchestration_workflow_proposal_imports.py and test_m365_conversation_lifecycle.py::test_real_conversation_deletion_fork_copy_and_retention_routes. Rerun alone → 7 passed.
• UI tests ran in local Chromium with PLAYWRIGHT_SERVICE_URL unset: python -m pytest ui_tests/test_m365_lifecycle_and_approvals.py ui_tests/test_v2_orchestration_workflow_proposal_card.py ui_tests/test_v2_workflow_ask_ai.py ui_tests/test_v2_workflow_change_tracking.py ui_tests/test_v2_orchestration_auto_open.py -q.
  • Baseline: 177 passed, 4 errors. After: 186 passed, 4 errors, the same 4 setup errors in test_v2_orchestration_auto_open.py.
  • The lifecycle and change-tracking files, rerun after the last UI edit → 124 passed. The last two commits change no UI.
• npm run typecheck and npm run build in application/v2_ui → passed.
• python scripts/build_docs_inventory.py → the inventory content is unchanged; the line-ending-only diff was restored. python -m pytest functional_tests/test_docs_app_surface_coverage.py functional_tests/test_docs_site_quality.py -q → 13 passed.
• Route policy tests on 1284fdfaf, though no routes changed:
  • python -m pytest functional_tests/route_tests/test_route_blueprint_policy_inventory.py -q → 11 passed
  • python -m pytest functional_tests/route_tests/test_route_unauthenticated_policy_contract.py -q → 6 passed
  • python -m pytest functional_tests/route_tests/test_route_policy_test_coverage.py -q → 2 passed
• Guardrails over fd842e199..1284fdfaf, 40 changed files:
  • python scripts/check_xss_sinks.py --base-sha fd842e199 --head-sha HEAD <changed files> → passed, 29 files.
  • python scripts/check_broken_access_control.py --base-sha fd842e199 --head-sha HEAD <changed files> → passed, 20 files.
  • python scripts/check_swagger_routes.py → not run, because no route files changed.
  • git diff --check fd842e199 HEAD → clean.
• An independent code review found two problems, both fixed with regression tests. In 873a191e1, a revocation racing a new self-authored binding could be undone. In 1284fdfaf, that fix had treated revocations made before this release, which withdrew a single binding, as revision-wide. A final review of 1284fdfaf found no remaining bugs.

Documentation

• Release notes updated, or not needed

• Feature documentation updated, or not needed

• Fix documentation updated, or not needed

• New: docs/explanation/features/M365_RUN_AS_SELF_AUTHORED_APPROVAL.md.

• Updated: the release notes (v0.261.229, Breaking Changes), docs/guides/microsoft-365-conversation-data.md and docs/guides/create-a-workflow.md. Also the feature docs for Microsoft 365 actions, workflow editor change tracking, the workflow AI assistant, chat workflow proposals, the workflow draft service, workflow calendar schedules and the orchestration roadmap.

• No fix doc: this is a behavior change, documented as a feature.

• Known limitation, documented: after Create, the proposal card judges a workflow by its own modified_by. When someone else later edits an agent it uses, the card shows that only once a run waits.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No routes or settings payloads were added or changed.