fix(policy): resource-scoped Cedar policies never enforced + release-prep runtime fixes#414
Merged
Merged
Conversation
The AGT CedarBackend builds the request resource from the `resource` key in the
evaluation context. The ingress proxy and the egress evaluator never set it, so
resource defaulted to Resource::"default" and any policy of the form
forbid(principal, action, resource == Resource::"<tool>");
silently never matched. In enforcing mode that default-denies every call; in
advisory mode it forwards every call regardless of policy. Set the resource to
the tool name at both ingress and egress.
Adds regression tests covering the context shape and end-to-end allow/deny.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…, session-close error - __version__ 0.1.0 -> 0.3.0 so `cmcp --version` matches the package - default policy_bundle_path policy/ -> policies/ to match the shipped examples - correct the auto-detect probe-order docstring to azure-cvm -> tpm -> sev-snp -> tdx - return a clear, actionable session-close error instead of a bare string Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
While validating the quickstart ahead of Tuesday's release party, the shipped example policies turned out not to enforce at all.
The runtime evaluates policy through AGT's
CedarBackend, which builds the requestresourcefrom aresourcekey in the evaluation context. Neither the ingress proxy (_build_cedar_context) nor the egress evaluator (authorize_egress) set it, so the resource defaulted toResource::"default". Any policy written asresource == Resource::"<tool>"therefore never matched:What
resourceto the tool name at ingress and egress, soresource == Resource::"<tool>"policies match. Verified end to end: sensitive tool returns 403 at the gateway with no upstream, permitted tool forwards and returns 200, and the signed claim recordsallowed: 1, denied: 1.test_resource_scoped_policy.py) pin the context shape and the allow/deny decision at ingress and egress.Smaller release-prep fixes in the second commit:
__version__0.1.0->0.3.0(matchedpyproject.toml, socmcp --versionis honest)policy_bundle_pathpolicy/->policies/to match the shipped examplesazure-cvm -> tpm -> sev-snp -> tdxFull unit suite: 820 passed, 6 skipped.
Docs and example/quickstart fixes (mock upstream, docker-compose, catalog
rotation_mode, CLI table, autodetect wording) follow in separate PRs per surface. This PR must merge first: the rewritten example policies depend on this resource fix to enforce.🤖 Generated with Claude Code