Python: preserve confidentiality through FIDES security tools

[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Hidden content can be safely passed into a transformation after the preceding layer, but result labeling must preserve confidentiality independently from integrity. Security tools must also publish the labels of the content they actually expose or derive rather than relying on generic fallback metadata.

Description & Review Guide

• What are the major changes? Preserves PRIVATE and USER_IDENTITY confidentiality through transformed and embedded-label results, publishes authoritative labels from inspect_variable and quarantined_llm, updates cumulative confidentiality for fully hidden results without integrity taint, and distinguishes internal quarantine wrappers from ordinary response-shaped JSON.
• What is the impact of these changes? Trusted transformations cannot implicitly declassify hidden inputs, inspection errors do not falsely taint integrity, and quarantine output remains UNTRUSTED at the combined input confidentiality.
• What do you want reviewers to focus on? Please focus on the separation of integrity precedence from confidentiality joins and the narrow quarantine payload-shape recognition.

Related Issue

Part of #7455. Depends on #8139 and is the third layer of a four-PR FIDES hardening stack.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

Quarantine payload detection still relies on forgeable JSON structure and can truncate ordinary hidden payloads.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Preserves FIDES confidentiality labels through transformations, inspection, quarantine, and hidden results.

Changes:

• Propagates input confidentiality independently of integrity precedence.
• Publishes authoritative labels for security-tool results.
• Narrows quarantine payload recognition and expands regression coverage.

File summaries

File	Description
security.py	Updates label propagation and security-tool parsing.
test_security.py	Adds confidentiality and quarantine regression tests.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (3 commit(s)): a01e735957c3, c36fcae00970, 446bfed4c263
Model: gpt-5.6-sol-fast

Overview

The PR makes result confidentiality monotonic across hidden inputs and embedded labels, adds authoritative parsers for the security tools, and narrows quarantine payload recognition; focused tests cover those intended invariants. Two residual trust-boundary failures remain: reflected inspect_variable errors can override untrusted invocation provenance, and malformed optional label metadata can discard otherwise valid integrity and confidentiality fields.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (1 high, 1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/security.py

[github-code-quality]

Code Coverage Overview

Languages: Python

Python / code-coverage/python

The overall line coverage in commit d800337 in the python-fides-label-c... branch is 91%. Line coverage data for the main branch is not yet available.

Show a line coverage summary of the most covered files.

File	main	python-fides-label-c... d800337	+/-
packages/core/a...work/_skills.py	—	95%	—
packages/core/a...ework/_tools.py	—	94%	—
packages/core/a.../_compaction.py	—	94%	—
packages/core/a...rk/_sessions.py	—	94%	—
packages/core/a...ework/_types.py	—	93%	—
packages/core/a...bservability.py	—	93%	—
packages/openai..._chat_client.py	—	92%	—
packages/core/a...amework/_mcp.py	—	91%	—
packages/ag-ui/...i/_agent_run.py	—	91%	—
packages/core/a...ork/security.py	—	85%	—

---

_{Updated September 09, 2026 10:13 UTC}

[Eduard van Valkenburg (eavanvalkenburg)]

/review

[github-actions]

MAF Automated Review — Iteration 2

Result: Findings reported
Scope: full PR (4 commit(s)): 7dbd951b3efc, c894ae48c4c5, c730173f6009, 384489e14ab5
Model: gpt-5.6-sol-fast

Overview

The change cleanly separates integrity precedence from confidentiality joins, preserves mandatory label fields when optional metadata is malformed, and uses internal markers plus scope-owned metadata to narrow result handling. The expanded tests cover hidden transformation inputs, malformed labels, inspection errors, and labeled quarantine inputs. One residual path allows a quarantine call with no labeled payload to publish PUBLIC confidentiality and override the tool's PRIVATE fallback, including for placeholder, model, and exception-derived output.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/security.py