Add Microsoft Defender for AI real-time protection on agent-hooks

[Krishnadheeraj (DheerajPannala)]

Summary

Adds opt-in real-time protection from Microsoft Defender for AI ("Defender RTP") to the Agent 365 Python SDK, on the Responsible AI agent-hooks control contract (AGENT-HOOKS-0.1). The host emits an agent-hooks context at each interception point, an interceptor posts it to Defender's prevention endpoint, and Defender's verdict decides allow or deny. The API matches the .NET SDK (microsoft/Agent365-dotnet#266) with Pythonic names.

• microsoft-agents-a365-tooling: new module microsoft_agents_a365.tooling.protection.defender, with no agent-hooks dependency.
  • DefenderRtpClient: evaluate_hook_context() sends a fitted copy of an agent-hooks/0.1 context to POST .../v1/protection/evaluate and returns a DefenderRtpEvaluationResult; prefetch_access_token() warms the token cache; is_evaluated_interception_point() and unavailable() as in .NET.
  • DefenderRtpOptions (from_environment()), DefenderRtpAgentContext, the DefenderRtpTokenResolver callable type, and DefenderRtpTokenResolvers.from_agentic_connection() (agent identity token).
  • The package now declares aiohttp, which it already imported.
• microsoft-agents-a365-tooling-extensions-agenthooks (new package): A365DefenderInterceptor (an agent-hooks interceptor registered as defender, with to_verdict()), A365DefenderCall, create_protection_emitter() (enforce mode, parallel/strictest) and add_a365_defender(). It depends on agent-hooks-sdk, imported as agent_hooks (agent-hooks on PyPI is an unrelated package).
• Workspace: the new package is registered in the root pyproject.toml (members, sources, and the centralized agent-hooks-sdk >= 0.1.0a5 constraint), uv.lock (the new member and agent-hooks-sdk 0.1.0a5 only), the published-metadata test, and the repo docs.
• Docs: package README, design docs, and CHANGELOGs ([Unreleased] → Added).

Scope: Defender RTP and the agent-hooks interceptor only. No Purview, no samples.

How it works

Interception points. Defender evaluates four points; any other point (agent_startup, model calls, agent_shutdown) is allowed locally with no call.

Point	When	On deny
input	the user's message, before the agent runs	the agent does not run
pre_tool_call	a tool call, before it runs	the tool does not run
post_tool_call	a tool result, before the agent uses it	the result is withheld
output	the reply, before it is sent	the reply is replaced

Request. Defender receives a fitted copy of the host's agent-hooks AgentContext, keeping its session, sequence and tool-call ids; the host's context is not modified (nor copied whole).

• spec = agent-hooks/0.1, timestamp in UTC, sequence ≥ 0 (numbered per session when missing).
• agent.id is the Entra agent identity, agent.framework is sanitized to ^[a-z0-9_-]+$, and session.id is required.
• target equals the point's field, tool_call/tool_result carry only spec members (content_hash and duration_ms are kept when valid), and loosely filled optional fields are repaired or dropped.
• tenant.id is always the agent's tenant, since it must equal the token's tid (a different host value is replaced); actor, request_id and model.id are filled from DefenderRtpAgentContext when missing (a request_id that is empty or not a string counts as missing).
• A valid sequence the host set is sent unchanged; the client doesn't repair the order of host values. A missing or invalid one is generated above the highest sequence seen in the session, host values included. The client tracks up to 1,000 sessions, and a session it no longer tracks continues above the highest sequence of every session it dropped, so generated values never repeat or decrease within a session.
• The envelope (agent, session, tenant, actor, request, model, trace, and roles, tool names and ids) is built from its spec fields alone (session keeps id, a UTC started_at and a non-negative turn; tenant its name; trace its ids), so nothing else a host puts there escapes the budget, and it is never cut, so the request validates whatever the limit. Content is fitted to a budget (see Long content).
• Every string and key is sent as valid Unicode: split surrogate pairs are rejoined and lone surrogates become U+FFFD, so such text can't keep the request from being sent. NaN and infinities are sent as text.
• Every optional node is shape-checked before it is read (context members such as model or the a365 extension, verdict members such as transform, 400 diagnostics, the token payload and the token response); one of an unexpected shape is ignored, so it can't turn a verdict into an unavailable result.

Correlation. Every call sends a unique x-ms-correlation-id (GUID), returned as DefenderRtpEvaluationResult.correlation_id; Defender logs the evaluation under it.

Verdict.

• allow proceeds, passing Defender's warnings and result_labels through to the agent-hooks verdict. A warning reason that is empty or in the host_error: namespace, which agent-hooks reserves and would reject as an invalid verdict (a deny), becomes defender:warning.
• deny blocks with Defender's message (reason defender:block:<reason>), and the agent-hooks verdict carries a correlation evidence pointer.
• transform also blocks, because this version doesn't apply rewrites.

Long content. Each content string is cut to A365_DEFENDER_RTP_MAX_CONTENT_CHARACTERS (default 20000, with a ...[truncated N chars] marker when it fits), and all content in one request shares a budget of four times that, so the request and the time to prepare it stay bounded. N counts characters as sent, so a rejoined surrogate pair is one; a non-ASCII string longer than the twice-the-limit prefix that is read gets ...[truncated], since counting the rest would mean reading all of it. The content under decision (the user's message, the tool call's arguments, the tool result, or the reply) is sent twice, as the point's field and as target, so it may use half of the budget. The rest goes, in order, to the called tool's declaration (below), the call's arguments at post_tool_call (already decided on at pre_tool_call, so cutting them is not a truncation), the other tool declarations, the newest messages, extensions and other members. Message histories, extension namespaces and the other declarations are read only as far as the budget reaches, so a long one costs no more than what is sent. Nesting deeper than 32 levels is cut. When the content under decision itself is cut, Defender evaluates a truncated copy, and its verdict can't cover the rest:

• a Defender deny (or transform) still blocks;
• an allow is not authoritative: the result has truncated=True and follows the fail mode (fail open allows with a defender:unverified warning, fail closed blocks with runtime_error:defender_unverified).

This closes a bypass where padding content past the limit put the rest beyond inspection, even when failing closed. Agents that handle long content should raise the limit.

The called tool's declaration. At pre_tool_call and post_tool_call, Defender's verdict also depends on how the called tool is declared, so its declaration counts like the content under decision:

• it is searched for by name among the first 10,000 entries of tools and charged right after the content under decision, ahead of the call's arguments at post_tool_call and of the other declarations, with its name whole; the other declarations then fill what is left of the budget in the host's order;
• an allow follows the fail mode (truncated=True, with its own error) when its description or schema had to be cut, or when tools is longer than 10,000 entries and the called tool isn't among the first 10,000;
• a list searched in full that doesn't declare the called tool is not a truncation. When none of the entries searched declares a tool, the called tool is declared from the a365 extension's tool.description, whose cut counts the same.

Authentication. Defender is always called app-only as the agent identity. That covers user turns, autonomous runs, A2A and startup prefetch, where there's no user token.

1. The Agents SDK connection returns the agent identity's assertion via AccessTokenProviderBase.get_agentic_application_token (implemented by MsalAuth). This is the same authority Observability S2S export uses.
2. from_agentic_connection exchanges it at https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token (client_credentials, client_id = agent identity, jwt-bearer client assertion) for api://86a21212-634e-4553-b3d6-e477e4c9d9ec/.default. The token carries the app role RealtimeProtection.Evaluate.All. The token-endpoint response body is never surfaced in errors.
3. Tokens are cached per tenant, agent and scope until they expire, with a single in-flight acquisition per key that is dropped when it completes; a failed acquisition is never cached. Within five minutes of expiry, a call refreshes the token in the background and keeps using the cached one, also when the refresh fails. A token resolver may be sync or async; a synchronous one runs on a worker thread, so it can't block the event loop or outlast the deadline, and since a timeout can't stop that thread, one call per agent, tenant and scope runs at a time, so a resolver that blocks can't pile up threads.

The endpoint and the token authority must be absolute HTTPS URLs, and redirects are not followed (a 3xx follows the fail mode, or is a token failure). The client keeps a private copy of its options, so a later change to the caller's object can't bypass that check.

Deadline and fail mode. Token acquisition and the call share one deadline (A365_DEFENDER_RTP_TIMEOUT_MILLISECONDS). On a timeout, transport error (including any exception from the HTTP session other than the caller's cancellation), token failure, an exception from the call resolver or the token resolver, a call resolver that returns no call (no agent identity), a non-2xx response or a response without a verdict, the result is marked not evaluated (evaluated=False, with error and http_status) and reaches on_evaluated. The call resolver runs only for the four points Defender evaluates while Defender RTP is enabled. When resolving the identity or evaluating raises, only the exception's type reaches the result (evaluation failed (<type>)), and so the verdict and the interception record, since its message can carry credentials or content; the exception is logged. on_evaluated runs on a worker thread once the verdict is decided, outside the emitter's interceptor timeout, so a slow or failing callback can't change the verdict.

• Fail open (the default) allows the action with an agent-hooks defender:unverified warning.
• A365_DEFENDER_RTP_FAIL_MODE=closed denies with runtime_error:defender_unverified, which is never reported as a detection. Only open and closed are accepted, so a typo can't silently fail open.
• A 400 surfaces the failed rules from Defender's diagnostics.validationErrors in error.

create_protection_emitter() sets the agent-hooks interceptor timeout to the Defender timeout plus two seconds, so the client's fail mode applies before an emitter timeout (which would deny whatever the fail mode). agent-hooks' own default interceptor timeout is 5 seconds, below the client's 10; the README tells hosts that build their own emitter to set it above the Defender timeout.

Configuration

Variable	Meaning
ENABLE_A365_DEFENDER_RTP	true (also 1, yes, on) to call Defender; false (0, no, off) or unset not to; any other value is rejected
A365_DEFENDER_RTP_ENDPOINT	the prevention endpoint, https://<host>/v1/protection/evaluate (required when enabled; HTTPS only)
A365_DEFENDER_RTP_FAIL_MODE	open (default) or closed, which blocks when no verdict is obtained; any other value is rejected
A365_DEFENDER_RTP_TIMEOUT_MILLISECONDS	one deadline for token acquisition and the call (default 10000)
A365_DEFENDER_RTP_AUTHENTICATION_SCOPE	overrides the Defender API scope
A365_DEFENDER_RTP_MAX_CONTENT_CHARACTERS	cuts each content string (default 20000); all content in a request shares four times that

Prerequisites.

• The agent identity's app-only token carries the application permission RealtimeProtection.Evaluate.All on the Defender API (86a21212-634e-4553-b3d6-e477e4c9d9ec). Add Defender permissions part of "a365 setup all" Agent365-devTools#485 adds this to a365 setup; until it ships, a tenant administrator grants it once per agent blueprint and every agent identity created from the blueprint inherits it (steps in the README).
• The agent's tenant is onboarded to Microsoft Defender for AI.

Otherwise Defender answers 403, which follows the fail mode.

defender = DefenderRtpClient(DefenderRtpOptions.from_environment())
tokens = DefenderRtpTokenResolvers.from_agentic_connection(
    connection_manager.get_default_connection()
)
activity = turn_context.activity
agent = DefenderRtpAgentContext(
    agent_id=activity.get_agentic_instance_id(),  # the agent identity
    tenant_id=activity.get_agentic_tenant_id(),  # the agent's tenant
)

emitter = add_a365_defender(
    create_protection_emitter(defender=defender.options),
    A365DefenderInterceptor(defender, lambda context: A365DefenderCall(agent, tokens)),
)
record = await emitter.emit_unchecked(builder.input(content=user_message))

Testing

• ruff check and ruff format --check pass; scripts/verify_constraints.py passes; uv lock --check passes.
• pytest tests/ -m "not integration": 1294 passed, 3 skipped, on Python 3.11 and 3.12 in CI (Linux) and on Python 3.12 locally (Windows). This includes the published-metadata test, which builds every package's wheel, now including the new one.
• 447 new test cases, each request body checked against the endpoint's request validation rules:
  • 303 DefenderRtpClient cases (including a 99-case grid for the truncation marker):
    • Forwarding: the disabled client and points Defender doesn't evaluate; the correlation id and agent identity; tool-call and tool-result fitting (content_hash and duration_ms kept when valid); repair of loose optional fields; fill-in from the agent context (a request_id that is empty or not a string falls back to the turn's); sequences per session, including a session dropped from the bounded cache.
    • Fitting: the envelope kept whole at a limit of 1, and built from its spec fields alone (megabytes of padding in session, tenant, trace and actor are not sent); members of an unexpected shape ignored.
    • Long content: every content string clamped; the content under decision limited to half the budget; the rest filled in order, with the called tool's declaration charged before the arguments at post_tool_call; histories read only as far as the budget reaches; a 100,000-item tool result bounded; deep nesting cut; oversized member names normalized at most once; an allow of a truncated copy following the fail mode, while a deny or transform of it still blocks.
    • The called tool: found in a padded list and declared first, whole; beyond the first 10,000 entries (or a longer list without it) following the fail mode, with nothing beyond those entries read for the search; absent from a list searched in full, with no truncation; its description or schema cut, or crowded out of the budget, following the fail mode; a deny still blocking; another tool's cut not counting; a cut description from the a365 extension counting.
    • Encoding: lone and split surrogates in values and keys (a split pair counts as the one character it becomes), the marker's count in characters as sent (no count when the omitted rest holds surrogates), and NaN or infinities, still sent and evaluated.
    • Verdicts: deny, allow with warnings, and transform-as-block, including verdict members of an unexpected shape.
    • Failures: fail open and closed on HTTP errors, token failures and unexpected session errors; 400 validation rules (including diagnostics of an unexpected shape); a 2xx with no decision, non-JSON bodies and unreadable bodies; the shared deadline across token acquisition and the call; caller cancellation.
    • Tokens: caching, prefetch, concurrent acquisition, cancelled and failed acquisitions, background refresh (including a failed refresh that keeps the cached token), tokens whose payload has an unexpected shape (used, not cached), and a blocking synchronous resolver that neither stalls the event loop nor outlasts the deadline, and is called once at a time.
  • 70 DefenderRtpOptions cases: environment parsing (an enable flag of true/1/yes/on or false/0/no/off and a fail mode of open or closed only; positive integers up to 2147483647), defaults (10 s, 20000 characters, fail open), HTTPS-only endpoints, and validation (including NaN, infinite and out-of-range timeouts and non-integer limits).
  • 26 from_agentic_connection cases: the token URL and form fields, the assertion (and a missing or non-string one), both get_agentic_application_token signatures (hosting-core 0.4 to 0.7, and 0.8+), non-2xx without the response body, token responses without a string access_token, cancellation, HTTPS-only authorities, and session handling.
  • 48 A365DefenderInterceptor cases, run under the real native agent-hooks emitter:
    • Verdicts: forward and allow; a denied tool call; emit() raising InterceptionBlocked; warnings and labels on an allow, including a reserved host_error: warning reason that no longer turns the allow into a deny; verdict mapping with evidence and labels.
    • Fail mode: Defender unavailable or timing out (no emitter timeout); an invalid identity; no agent identity resolved; a failing call resolver or token resolver, with only the exception's type in the record and the exception logged.
    • Scope: points Defender doesn't evaluate, and a disabled client (no call resolved).
    • Long content: 20,000 harmless characters plus a payload Defender would deny (fail closed blocks, fail open allows with a warning); a deny or transform of truncated content still blocks; a called tool beyond the first 10,000 declarations following the fail mode.
    • Other: a lone surrogate in an emitted tool argument never failing open; an async call resolver; a failing evaluation callback, and a slow one that neither holds up nor changes the verdict; the emitter settings, including a rejected interceptor timeout that is not positive and finite.
• End to end: verified live against the Defender prevention endpoint (re-run after the request-fitting changes), with the agent-hooks emitter and A365DefenderInterceptor running fail-closed and authenticating as an agent identity through from_agentic_connection: clean traffic was allowed at all four points; a known-malicious URL passed as a tool argument was denied at pre_tool_call (defender:block:prevention_blocked) and the tool did not run.

Known limitations and follow-ups

• Long content is not fully evaluated. Content beyond the budget isn't sent; an allow of a truncated copy follows the fail mode (it never authorizes the unseen rest). Evaluating long content in chunks would give full coverage under fail open at the cost of extra calls; that is a follow-up.
• Response sizes are not capped. Bodies from the Defender endpoint and the token authority are read whole, within the deadline. Both are trusted HTTPS services with redirects refused, as in the .NET and Node.js SDKs; a size cap would be cross-SDK hardening.
• transform is treated as a block. This version doesn't apply Defender rewrites (transform_path is surfaced on the verdict).
• Prerelease dependency. agent-hooks-sdk is prerelease. The constraint is >= 0.1.0a5 and the lock resolves 0.1.0a5; bumping to 0.1.0b1 is a follow-up (the emitter, context and interceptor APIs this package uses are unchanged in 0.1.0b1). Its native core ships wheels for Windows x64, manylinux x86_64/aarch64 and macOS only, so the extension doesn't install on musl (Alpine); the core client in microsoft-agents-a365-tooling does.
• Not yet wired into the hosting pipeline. Hosts register the interceptor on their own agent-hooks emitter; wiring it into the Agents SDK hosting pipeline is a follow-up.
• The Defender permission needs the CLI change. a365 setup grants the Defender permission only once Add Defender permissions part of "a365 setup all" Agent365-devTools#485 ships; until then it's granted manually (see the README).
• hosting-core before 0.8. In microsoft-agents-hosting-core 0.4 to 0.7 (the declared floor is 0.4.0), get_agentic_application_token takes no tenant, so the assertion comes from the connection's configured tenant; 0.8 and later pass the agent's tenant.

Related work

This is the Python part of a three-SDK change:

• Add Microsoft Defender for AI real-time protection on agent-hooks Agent365-dotnet#266: the .NET counterpart.
• Add Microsoft Defender for AI real-time protection on agent-hooks Agent365-nodejs#310: the Node.js counterpart.
• Add Defender permissions part of "a365 setup all" Agent365-devTools#485: Defender permissions (RealtimeProtection.Evaluate.All) as part of a365 setup all.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/agent-hooks-sdk	0.1.0a5	Unknown	Unknown

Scanned Files

• uv.lock

[Copilot]

🟡 Changes recommended

Security configuration mutability and request-normalization defects can bypass or invalidate Defender evaluation.

4 open findings

• Exposed mutable options allow HTTPS validation bypass · New
• Mismatched tenant ID can trigger fail-open evaluation bypass · New
• Valid sequence values do not advance session high-water mark · New
• Truncation marker causes strings to exceed configured maximum · New

What changed in this PR

Adds opt-in Microsoft Defender for AI real-time protection through a core tooling client and a new agent-hooks extension.

Changes:

• Implements Defender request normalization, authentication, caching, verdicts, and fail modes.
• Adds agent-hooks interception and workspace packaging.
• Adds comprehensive tests and documentation.

File	Description
uv.lock	Locks the new package and dependencies.
tests/​tooling/​protection/​test_defender_rtp_token_resolvers.py	Tests token exchange behavior.
tests/​tooling/​protection/​test_defender_rtp_options.py	Tests configuration parsing and validation.
tests/​tooling/​protection/​test_defender_rtp_client.py	Tests client requests, verdicts, failures, and caching.
tests/​tooling/​protection/​defender_fakes.py	Provides Defender test doubles.
tests/​tooling/​protection/​__init__.py	Initializes protection tests.
tests/​tooling/​extensions/​agenthooks/​test_a365_defender_interceptor.py	Tests interceptor integration.
tests/​tooling/​extensions/​agenthooks/​__init__.py	Initializes agent-hooks tests.
tests/​test_published_security_constraints.py	Registers package security constraints.
tests/​test_dependency_constraints.py	Registers dependency checks.
tests/​RUNNING_TESTS.md	Adds extension installation instructions.
README.md	Lists the new package.
pyproject.toml	Registers workspace package and dependency.
libraries/​microsoft-agents-a365-tooling/​pyproject.toml	Declares aiohttp.
libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_token_resolvers.py	Implements agent identity token exchange.
libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_options.py	Defines Defender configuration.
libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_evaluation_result.py	Defines evaluation models.
libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_client.py	Implements Defender evaluation.
libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_agent_context.py	Defines agent and token context.
libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​_http.py	Manages HTTP sessions.
libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​__init__.py	Exports Defender APIs.
libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​__init__.py	Introduces protection namespace.
libraries/​microsoft-agents-a365-tooling/​docs/​design.md	Documents Defender architecture.
libraries/​microsoft-agents-a365-tooling/​CHANGELOG.md	Records core tooling additions.
libraries/​microsoft-agents-a365-tooling-extensions-agenthooks/​setup.py	Configures package versioning.
libraries/​microsoft-agents-a365-tooling-extensions-agenthooks/​README.md	Documents setup and usage.
libraries/​microsoft-agents-a365-tooling-extensions-agenthooks/​pyproject.toml	Defines package metadata.
libraries/​microsoft-agents-a365-tooling-extensions-agenthooks/​microsoft_agents_a365/​tooling/​extensions/​agenthooks/​a365_defender_interceptor.py	Maps Defender results to hook verdicts.
libraries/​microsoft-agents-a365-tooling-extensions-agenthooks/​microsoft_agents_a365/​tooling/​extensions/​agenthooks/​a365_agent_hooks.py	Creates and registers emitters.
libraries/​microsoft-agents-a365-tooling-extensions-agenthooks/​microsoft_agents_a365/​tooling/​extensions/​agenthooks/​__init__.py	Exports extension APIs.
libraries/​microsoft-agents-a365-tooling-extensions-agenthooks/​docs/​design.md	Documents extension design.
libraries/​microsoft-agents-a365-tooling-extensions-agenthooks/​CHANGELOG.md	Records the new package.
docs/​design.md	Adds package architecture references.
DEPENDENCIES.md	Updates the dependency graph.
CLAUDE.md	Adds the package to repository guidance.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

Redirect handling and several context/configuration invariants can leak sensitive data or produce incorrect protection decisions.

10 open findings

• Do not suppress unexpected resolver exceptions · New
• Prevent redirects from leaking agent context · New
• Disable redirects during token exchange · New
• Mismatched tenant ID can trigger fail-open evaluation bypass
• Exposed mutable options allow HTTPS validation bypass
• Skip resolver when protection is inactive · New
• Override untrusted host tenant IDs · New
• Truncation marker causes strings to exceed configured maximum
• Valid sequence values do not advance session high-water mark
• Remove duplicate Unreleased Added heading · New

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

Redirect handling can expose sensitive request bodies, while low content limits can invalidate Defender contract fields and fail open.

0 open findings

10 resolved since last review

• Disable redirects during token exchange
• Prevent redirects from leaking agent context
• Do not suppress unexpected resolver exceptions
• Mismatched tenant ID can trigger fail-open evaluation bypass
• Exposed mutable options allow HTTPS validation bypass
• Override untrusted host tenant IDs
• Skip resolver when protection is inactive
• Truncation marker causes strings to exceed configured maximum
• Valid sequence values do not advance session high-water mark
• Remove duplicate Unreleased Added heading

Previously missed (1)

In code that hasn't changed since last review

Generic clamping corrupts schema-constrained metadata

libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_client.py:390

This generic clamp also rewrites contract metadata. For example, with max_content_characters=3, input.role="user" becomes "use"; a long sanitized agent.framework gets a marker containing characters outside ^[a-z0-9_-]+$. Defender then rejects the request and the default fail-open mode allows the action unevaluated. Make clamping path-aware for fixed enums/schema-constrained fields (or otherwise preserve their validity), and cover a low-cap request in the contract tests.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

Content clamping can invalidate identity metadata and valid agent-hooks fields are discarded.

0 open findings

Previously missed (2)

In code that hasn't changed since last review

Rebuilding objects drops valid content hash and duration fields

libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_client.py:367

Rebuilding these objects drops valid AGENT-HOOKS-0.1 members: tool_call.content_hash is lost here, and tool_result.duration_ms is likewise omitted below. The alpha.5 contract defines both as optional spec fields, and the native builder can emit duration_ms, so valid host context is silently changed rather than merely filtering provider-specific members. Preserve these fields when they satisfy their contract validation.

Content clamping truncates tenant and agent identity IDs

libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_client.py:389

The recursive clamp also truncates tenant.id (and agent.id). For example, the accepted value max_content_characters=1 changes a normal Entra tenant GUID to one character, so it no longer matches the token's tid; Defender then rejects every request and the default fail-open mode allows actions without evaluation. Exempt identity/contract metadata from content clamping (or enforce a safe lower bound) and cover a low-limit request where the tenant ID remains intact.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

Numeric validation and low content limits can disable deadlines, hang truncation, or invalidate Defender requests.

1 open finding

• Prevent clamping of structural and identity fields · New

Previously missed (1)

In code that hasn't changed since last review

Reject non-finite timeout values

libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_options.py:138

validate() accepts NaN and positive infinity because both make <= 0 false. Infinity removes the documented per-call deadline, while NaN produces an invalid event-loop deadline. Reject non-finite timeout values.

This issue also appears on line 141 of the same file.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

Dependency compatibility, Unicode truncation, and option validation issues remain unresolved.

3 open findings

• Normalize Unicode before truncating content · New
• Reject non-finite timeouts and invalid content limits · New
• Raise hosting-core dependency floor for agentic token API · New

1 resolved since last review

• Prevent clamping of structural and identity fields

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

The bounded sequence cache can violate the agent-hooks ordering contract for revisited sessions.

2 open findings

• Raise hosting-core dependency floor for agentic token API
• Normalize Unicode before truncating content

2 resolved since last review

• Prevent clamping of structural and identity fields
• Reject non-finite timeouts and invalid content limits

Previously missed (1)

In code that hasn't changed since last review

Prevent sequence reset for live sessions after cache eviction

libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_client.py:799

The bounded sequence cache can reset a live session after 1,000 other sessions are observed. When that session next omits sequence, _next_sequence() starts it again at 1, producing a duplicate/decreasing value even though AGENT-HOOKS-0.1 requires sequence values to be unique and strictly increasing within a session. Preserve high-water state for the full session lifetime, or require caller-provided sequence values once state cannot be retained.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

Synchronous resolver execution and unbounded tool/message traversal can defeat the promised deadline and block the event loop.

0 open findings

3 resolved since last review

• Raise hosting-core dependency floor for agentic token API
• Reject non-finite timeouts and invalid content limits
• Normalize Unicode before truncating content

Previously missed (3)

In code that hasn't changed since last review

Synchronous token resolver bypasses timeout and blocks event loop

libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_client.py:763

The timeout cannot bound a synchronous token resolver because the resolver is invoked directly on the event-loop thread; while it blocks, the timeout callback cannot run. Since DefenderRtpTokenResolver explicitly permits synchronous implementations, both evaluation and prefetch can exceed the configured deadline and stall unrelated async work. Run synchronous resolvers off the event loop, or make the public resolver contract async-only.

Unbounded tool-list scan and copy delays Defender evaluation

libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_client.py:977

At tool interception points this searches the entire host-supplied tool list and then copies the whole list before the fitter applies its budget. A sufficiently large tool registry therefore makes request preparation unbounded in CPU and memory, blocks the event loop, and can consume the Defender deadline before any evaluation occurs. Avoid the full scan/copy—for example, synthesize the called-tool declaration and consume only as many declarations as the remaining budget permits.

Full message pre-pass causes unbounded synchronous preparation

libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_client.py:1020

This all(...) pre-pass traverses every message before the content budget is considered. Long conversation histories therefore have unbounded preparation time even though only the newest budget-fitting messages are sent; because this runs synchronously, it can also block the event loop past the Defender deadline. Validate messages incrementally while traversing newest-first and stop once the budget is exhausted.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

Surrogate-pair truncation reports an incorrect omitted-character count, and sequence documentation overstates monotonicity.

1 open finding

• Sequence guarantee incorrectly claims monotonic host-provided values · New

Previously missed (1)

In code that hasn't changed since last review

Truncated count miscalculates normalized surrogate pairs

libraries/​microsoft-agents-a365-tooling/​microsoft_agents_a365/​tooling/​protection/​defender/​defender_rtp_client.py:988

The omitted-count marker is incorrect when the truncated text contains UTF-16 surrogate pairs. This prefix is normalized before measuring, but the unseen tail is counted with its pre-normalization length; for 1,000 split-pair emoji at a limit of 40, the request reports ...[truncated 1945 chars] although only 985 normalized characters were omitted. That contradicts the API's rule that a split pair counts as the one character it becomes. Either determine the normalized omitted count or avoid emitting a numeric marker when it cannot be computed within the bounded-work requirement.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

Reserved warning handling, unsafe fail-mode parsing, unbounded envelope copying, and callback/error propagation can alter enforcement or expose data.

5 open findings

• Remap reserved host_error warning reasons · New
• Reject unknown fail-open or fail-closed configuration values · New
• Prevent resolver exception details from leaking · New
• Dispatch telemetry callbacks outside interception timeout · New
• Bound copied envelope fields to prevent oversized allocations · New

1 resolved since last review

• Sequence guarantee incorrectly claims monotonic host-provided values

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🟡 Changes recommended

Unbounded response buffering, suffix scanning, and lingering resolver threads create unresolved resource-exhaustion risks.

4 open findings

• Unbounded prevention response buffering enables memory exhaustion · New
• Token endpoint response lacks a maximum body size · New
• Timed-out resolver workers accumulate and exhaust the executor · New
• Truncated suffix scanning can block the event loop · New

5 resolved since last review

• Reject unknown fail-open or fail-closed configuration values
• Remap reserved host_error warning reasons
• Bound copied envelope fields to prevent oversized allocations
• Dispatch telemetry callbacks outside interception timeout
• Prevent resolver exception details from leaking

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[Copilot]

🔵 Needs a closer look

The extension documentation incorrectly states that non-finite values reach Defender despite agent-hooks rejecting them before interceptor dispatch.

0 open findings

4 resolved since last review

• Token endpoint response lacks a maximum body size
• Unbounded prevention response buffering enables memory exhaustion
• Truncated suffix scanning can block the event loop
• Timed-out resolver workers accumulate and exhaust the executor

Previously missed (1)

In code that hasn't changed since last review

Document non-finite number limitation in emitter path

libraries/​microsoft-agents-a365-tooling-extensions-agenthooks/​README.md:191

The non-finite-number claim does not hold for this extension's documented emitter path. agent-hooks-sdk 0.1.0a5 serializes the context with allow_nan=False and maps NaN/Infinity to a fail-closed host_error:context_invalid before invoking any interceptor, so this interceptor cannot convert or send them and the configured Defender fail mode is not applied. Please document that limitation instead of promising conversion.

🧠 Review effort: Balanced