[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Updates tier-3 result labeling in LabelTrackingFunctionMiddleware.

Description & Review Guide

• What are the major changes? Use labels from resolved, owned variable references as the integrity baseline, or default_integrity when no references resolve. Combine argument-label restrictions with that baseline. Update the developer guide and add regression coverage.
• What is the impact of these changes? Argument labels can lower, but not raise, baseline integrity. Explicit source_integrity precedence, owned-reference inheritance, confidentiality propagation, and principal handling are unchanged.
• What do you want reviewers to focus on? The fallback calculation and tests covering nested labels, dictionary/model/keyword arguments, quarantine, context taint, and owned-reference handling.

Related Issue

N/A — no linked public issue.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

No unresolved blocking issues were identified.

Pull request overview

Updates Python FIDES label tracking so argument labels restrict, but do not promote, fallback integrity.

Changes:

• Derives fallback integrity from owned labels or configured defaults.
• Adds regression coverage for precedence, quarantine, confidentiality, and taint.
• Updates the FIDES developer guide.

File summaries

File	Description
python/samples/02-agents/security/FIDES_DEVELOPER_GUIDE.md	Documents revised label propagation rules.
python/packages/core/tests/test_security.py	Adds comprehensive regression coverage.
python/packages/core/agent_framework/security.py	Implements restricted fallback integrity calculation.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite (auto)

Note

Copilot is running an experiment and ran this review at Lite.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 8b4f94eee860
Model: gpt-5.6-sol-fast

Overview

The PR hardens tier-3 result labeling by deriving integrity from owned resolved references or the configured default and allowing argument labels only to restrict that baseline. Owner-aware resolution, restrictive label combination, explicit source-integrity precedence, and the new argument-shape and precedence matrices provide strong guards around the changed behavior. No PR-introduced Critical, High, or Medium defect was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.