Python: enforce FIDES labels on expanded variables

[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

FIDES can hide untrusted tool output behind variable references, but expanding those references into later tool arguments previously lost the stored labels. A sink could therefore receive hidden untrusted or confidential content while policy evaluated only the model-visible conversation.

Description & Review Guide

• What are the major changes? Resolves hidden references together with their stored labels, publishes per-invocation argument/effective labels, enforces integrity and confidentiality policy against resolved arguments, binds approvals to the exact resolved snapshot, and preserves owner-aware variable boundaries.
• What is the impact of these changes? Blind forwarding of hidden content is blocked or approved according to the destination tool's declarations without exposing that content to the model context.
• What do you want reviewers to focus on? Please focus on resolver completeness, argument-label policy semantics, foreign variable handling, and approval replay binding.

Related Issue

Part of #7455. Depends on #8138 and is the second layer of a four-PR FIDES hardening stack.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

Approval canonicalization rejects supported enum arguments, while breaking behavior and function-loop integration coverage also need resolution.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds FIDES enforcement for labels retained by expanded hidden variables and binds approvals to resolved invocation snapshots.

Changes:

• Resolves hidden references with integrity/confidentiality labels.
• Enforces argument policies and session ownership.
• Adds approval replay and isolation tests.

File summaries

File	Description
security.py	Implements resolution, policy enforcement, session scoping, and approval binding.
test_security.py	Tests variable policies, session isolation, and approval replay.
FIDES_DEVELOPER_GUIDE.md	Documents sessions and hidden-variable forwarding.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 1424d287c59b
Model: gpt-5.6-sol-fast

Overview

The change resolves owned hidden-variable references together with their labels, evaluates policy against the combined context and argument labels, and binds approvals to strict original and resolved invocation snapshots. Session ownership checks, task-local scope activation, strict durable serialization, fail-closed approval binding, and focused tests for cross-session access and replay changes provide concrete guardrails. No PR-introduced Critical, High, or Medium defect remained after reconciliation.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.

[github-code-quality]

Code Coverage Overview

Languages: Python

Python / code-coverage/python

The overall line coverage in commit 052698c in the python-fides-argumen... branch is 91%. Line coverage data for the main branch is not yet available.

Show a line coverage summary of the most covered files.

File	main	python-fides-argumen... 052698c	+/-
packages/core/a...work/_skills.py	—	95%	—
packages/core/a...ework/_tools.py	—	94%	—
packages/core/a.../_compaction.py	—	94%	—
packages/core/a...rk/_sessions.py	—	94%	—
packages/core/a...ework/_types.py	—	93%	—
packages/core/a...bservability.py	—	93%	—
packages/openai..._chat_client.py	—	92%	—
packages/core/a...amework/_mcp.py	—	91%	—
packages/ag-ui/...i/_agent_run.py	—	91%	—
packages/core/a...ork/security.py	—	84%	—

---

_{Updated September 09, 2026 09:10 UTC}