[westey (westey-m)]

Motivation & Context

Improve documentation around what to consider when doing standing approvals with agent upgrades / multiple agents.

Description & Review Guide

Improve documentation around what to consider when doing standing approvals with agent upgrades / multiple agents.

Related Issue

Fixes #

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details:

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

The required Related Issue and AI Assistance fields remain incomplete.

0 open findings

What changed in this PR

Adds security guidance for reusing session-backed standing tool approvals across changed agents and tool sets.

Changes:

• Warns that approvals may match replacement tools with identical names.
• Highlights risks involving externally sourced tools such as MCP.

File	Description
python/​packages/​core/​agent_framework/​_harness/​_tool_approval.py	Documents standing-approval reuse risks.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 5be85e2dcc1c
Model: gpt-5.6-sol

Overview

This documentation-only PR adds security warnings that describe standing approvals as session-persistent and not bound to a particular agent or tool instance. The implementation requires pending-request binding, scopes hosted calls by server label, supports exact-argument rules, and stores the rules in the caller-supplied AgentSession. No publishable Critical, High, or Medium defect was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.