[Roger Barreto (rogerbarreto)]

Motivation & Context

Keep discovered Foundry Toolbox functions consistent with their advertised tool-approval configuration and the framework's existing approval workflow.

Description & Review Guide

• What are the major changes? Apply the existing ApprovalRequiredAIFunction wrapper when Toolbox metadata requires approval. Recognize an existing approval service before consulting metadata. Explicit unsupported configuration requires approval and emits a warning.
• What is the impact of these changes? Approval is handled consistently for startup discovery, lazy discovery, deferred retries, and consent retries. Tools with absent approval configuration or an explicit never policy retain their normal behavior, and OAuth consent handling remains intact.
• What do you want reviewers to focus on? Wrapper composition, metadata compatibility, and the per-call approval lifecycle. The 27 new regression cases cover existing approval services, configuration variants, approval and rejection, original-argument binding, repeated calls, streaming, request-time discovery, and consent propagation.

Local checks used .NET SDK 10.0.402 and Debug builds. Commands below run from dotnet/.

Command	Result
dotnet build tests\Microsoft.Agents.AI.Foundry.Hosting.UnitTests -c Debug --no-restore --tl:off --warnaserror	Passed on Windows for net8.0, net9.0, and net10.0; no warnings or errors.
dotnet test --project tests\Microsoft.Agents.AI.Foundry.Hosting.UnitTests -f net8.0 -c Debug --no-build	563 passed, 0 failed, 1 existing skip.
dotnet test --project tests\Microsoft.Agents.AI.Foundry.Hosting.UnitTests -f net9.0 -c Debug --no-build	563 passed, 0 failed, 1 existing skip.
dotnet build tests/Microsoft.Agents.AI.Foundry.Hosting.UnitTests -f net10.0 -c Debug --tl:off --warnaserror	Passed in the Linux CI SDK image; no warnings or errors.
dotnet test --project tests/Microsoft.Agents.AI.Foundry.Hosting.UnitTests -f net10.0 -c Debug --no-build	563 passed, 0 failed, 1 existing skip in the Linux CI SDK image. The Windows net10.0 coverage run had the same result.
dotnet format src/Microsoft.Agents.AI.Foundry.Hosting --verify-no-changes --verbosity diagnostic	Passed in mcr.microsoft.com/dotnet/sdk:10.0.
dotnet format tests/Microsoft.Agents.AI.Foundry.Hosting.UnitTests --verify-no-changes --verbosity diagnostic	Passed in mcr.microsoft.com/dotnet/sdk:10.0.
dotnet build tests\Foundry.Hosting.IntegrationTests -f net10.0 -c Debug --no-restore --tl:off --warnaserror	Passed; live integration tests were not run.

The affected hosting module has 90.05% line coverage. These are scoped local results, not a claim that the full solution or published-head CI has passed.

Related Issue

N/A - maintainer-directed consistency correction; no public tracking issue. No competing open PR changes Toolbox approval configuration handling.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: implementation, regression tests, XML documentation, validation, and this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after a language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

No blocking issues remain in metadata handling, wrapper composition, or regression coverage; tests were not independently executed.

No open issues 🎉

What changed in this PR

This PR connects Foundry Toolbox approval metadata to the framework’s existing per-call approval workflow while preserving OAuth consent handling.

Changes:

• Wraps discovered tools with ApprovalRequiredAIFunction when required, prioritizing existing approval services over metadata.
• Requires approval and logs a warning for explicit unsupported or malformed configurations.
• Adds 27 regression cases covering metadata variants, approval decisions, streaming, discovery paths, and consent propagation.

File	Description
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​FoundryToolboxApprovalTests.cs	Adds approval lifecycle, metadata, discovery, and consent regression tests.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​FoundryToolboxService.cs	Applies and documents approval policies during centralized tool discovery.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): b086ea734e3b
Model: gpt-5.6-sol

Overview

The change centralizes toolbox approval-policy interpretation in the common open path, so startup, lazy, deferred, and consent-retry discovery all receive the same wrapper composition. Unsupported explicit metadata fails closed, existing approval markers take precedence, and the regression suite covers policy variants, repeated decisions, streaming, argument binding, and OAuth consent propagation. No PR-introduced Critical, High, or Medium defect remained after reconciliation.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.