Uchi Uchibeke a29134d7c9 feat(guardrails): add pre-tool-call authorization middleware with pluggable providers (#1240) ...

Add GuardrailMiddleware that evaluates every tool call before execution.
Three provider options: built-in AllowlistProvider (zero deps), OAP passport
providers (open standard), or custom providers loaded by class path.

- GuardrailProvider protocol with GuardrailRequest/Decision dataclasses
- GuardrailMiddleware (AgentMiddleware, position 5 in chain)
- AllowlistProvider for simple deny/allow by tool name
- GuardrailsConfig (Pydantic singleton, loaded from config.yaml)
- 25 tests covering allow/deny, fail-closed/open, async, GraphBubbleUp
- Comprehensive docs at backend/docs/GUARDRAILS.md

Closes #1213

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>

2026-03-23 18:07:33 +08:00

..

__init__.py

feat(guardrails): add pre-tool-call authorization middleware with pluggable providers (#1240)

2026-03-23 18:07:33 +08:00

builtin.py

feat(guardrails): add pre-tool-call authorization middleware with pluggable providers (#1240)

2026-03-23 18:07:33 +08:00

middleware.py

feat(guardrails): add pre-tool-call authorization middleware with pluggable providers (#1240)

2026-03-23 18:07:33 +08:00

provider.py

feat(guardrails): add pre-tool-call authorization middleware with pluggable providers (#1240)

2026-03-23 18:07:33 +08:00