[Suhas Aggarwal (suhasagg)]

Motivation & Context

Microsoft Agent Framework provides FIDES middleware for security policy enforcement. However, CodeAct integrations using Monty and Hyperlight execute generated code that can invoke registered host functions through nested execution paths.

These nested host-tool calls are not currently mediated by FIDES. Applications requiring comprehensive FIDES coverage therefore need an explicit way to reject unsupported execution configurations rather than assume that sandbox isolation or existing middleware automatically provides policy enforcement.

This PR introduces an opt-in, fail-closed FIDES coverage requirement for Python CodeAct integrations.

The goal is to prevent registered host functions from executing through an unsupported FIDES security boundary while preserving existing behavior for applications that do not enable strict coverage.

Description & Review Guide

What are the major changes?

1. Introduce an explicit security coverage requirement

Add require_fides=True support to:

• MontyCodeActProvider
• MontyExecuteCodeTool
• HyperlightCodeActProvider
• HyperlightExecuteCodeTool

The default remains False for backward compatibility.

2. Fail closed when nested host tools are registered

When strict coverage is enabled, CodeAct rejects nonempty managed host-tool registries because nested host-tool execution does not currently provide FIDES mediation.

This applies regardless of whether individual tools contain FIDES-related metadata.

The implementation introduces CodeActFidesCoverageError to distinguish unsupported security coverage from ordinary execution failures.

3. Protect multiple execution and registration paths

Coverage checks address:

• Initial host-tool registration
• Dynamic tool additions
• Execution-time validation
• Run-scoped tool snapshots
• Nested host-tool dispatch paths

The intended invariant is that unsupported nested host-tool execution is rejected before the host-tool body runs.

4. Preserve supported execution scenarios

Strict mode still permits code execution when no managed host tools are registered.

With require_fides=False, existing CodeAct behavior remains unchanged.

5. Add documentation and regression coverage

Update the Monty and Hyperlight READMEs to document configuration, security guarantees, limitations, and alternatives.

Add focused regression tests for strict-mode behavior, rejection paths, and execution without registered host tools.

What is the impact of these changes?

Security

• Provides an explicit fail-closed option for applications requiring FIDES coverage.
• Prevents unsupported nested host-tool execution from being mistaken for FIDES-mediated execution.
• Makes the security limitation visible through a dedicated exception.
• Reduces the risk of accidentally bypassing expected host-tool policy enforcement.

Compatibility

• Fully opt-in through require_fides=True.
• No intended breaking changes to existing configurations.
• Code execution without registered host tools remains available in strict mode.

Scope and limitations

This PR does not implement full FIDES mediation for nested CodeAct host tools.

It also does not provide FIDES enforcement for filesystem access, network access, or intermediate program values.

Applications requiring security-sensitive host tools should expose those functions as direct agent tools under their existing FIDES middleware.

The strict option should be configured by trusted application code rather than treated as automatic middleware detection.

Validation

Targeted FIDES regression tests

• Monty and Hyperlight: 29 passed

Broader regression testing

• Monty and Hyperlight non-integration suites: passed, with 6 skipped tests

Static checks

• Ruff lint: passed
• Ruff formatting: passed
• Git whitespace validation: passed

Known integration-testing limitation

A Hyperlight real-sandbox integration run encountered an invalid size: invalid digit found in string error associated with the existing sandbox size-configuration format and the installed hyperlight-sandbox version.

The relevant size-formatting code predates this PR. This compatibility issue is outside the scope of the proposed FIDES coverage changes, and the affected real-sandbox integration test has not been demonstrated to pass.

What do you want reviewers to focus on?

1. Whether rejecting all registered nested host tools is the appropriate fail-closed behavior until FIDES mediation is available.
2. Whether the validation points sufficiently cover registration, dynamic additions, run-scoped snapshots, and execution paths.
3. Whether the public require_fides option and dedicated exception fit the framework's existing API conventions.
4. Whether the documentation accurately describes the security guarantees without implying full FIDES enforcement.
5. Whether the implementation is appropriately scoped as an incremental security-hardening capability.

Related Issue

Fixes #9251

This PR implements the opt-in fail-closed coverage approach for Python Monty and Hyperlight CodeAct integrations.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details:

AI assistance was used for implementation , regression-test design. The changes were reviewed and validated locally.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception
• This is not a breaking change.

[Copilot]

🔵 Needs a closer look

The security-sensitive boundary spans two execution runtimes, and the Hyperlight real-sandbox path remains unverified.

2 open findings

• Document CodeActFidesCoverageError in exception hierarchy · New
• Update API guide for require_fides constructor option · New

What changed in this PR

Adds opt-in fail-closed FIDES coverage for Python CodeAct host tools.

Changes:

• Adds require_fides to Monty and Hyperlight providers/tools.
• Rejects nested host-tool registration and execution in strict mode.
• Adds documentation, exception handling, and regression tests.

File	Description
python/​packages/​core/​agent_framework/​exceptions.py	Adds the dedicated coverage exception.
python/​packages/​monty/​agent_framework_monty/​_provider.py	Exposes strict mode through the provider.
python/​packages/​monty/​agent_framework_monty/​_execute_code_tool.py	Enforces fail-closed behavior across execution paths.
python/​packages/​monty/​tests/​monty/​test_fides_fail_closed.py	Tests Monty strict-mode behavior.
python/​packages/​monty/​README.md	Documents Monty configuration and limitations.
python/​packages/​hyperlight/​agent_framework_hyperlight/​_provider.py	Exposes strict mode through the provider.
python/​packages/​hyperlight/​agent_framework_hyperlight/​_execute_code_tool.py	Enforces strict mode through sandbox configuration and callbacks.
python/​packages/​hyperlight/​tests/​hyperlight/​test_hyperlight_fides_fail_closed.py	Tests Hyperlight rejection paths and side effects.
python/​packages/​hyperlight/​README.md	Documents Hyperlight configuration and limitations.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Eduard van Valkenburg (eavanvalkenburg)]

Suhas Aggarwal (@suhasagg) the issue mentioned waiting for the core team to review the issue before creating a PR, so closing this.