Skip to content

Add explicit fail-closed sidecar risk provider - #42

Merged
Brandon Werner (brandwe) merged 1 commit into
mainfrom
fix/26-unlicensed-risk-fallback
Sep 1, 2026
Merged

Add explicit fail-closed sidecar risk provider#42
Brandon Werner (brandwe) merged 1 commit into
mainfrom
fix/26-unlicensed-risk-fallback

Conversation

@brandwe

Copy link
Copy Markdown
Member

Summary

  • preserve Entra ID Protection as the default risk source
  • add an explicit authenticated sidecar risk provider for tenants without risky-agent API licensing
  • fail closed when sidecar risk is missing or unreachable
  • expose the active provider in the portal and direct A2A enforcement results
  • wire and validate CA_RISK_PROVIDER through the supported deployment flow

Validation

  • 43 portal unit tests passed
  • 53 shared unit tests passed
  • bash -n deploy.sh passed
  • fresh Azure deployment completed successfully
  • live enforcement matrix passed 22/22
  • portal and Security Portal health endpoints return HTTP 200

Closes #26

Keep Entra risk evaluation as the default while allowing licensed-feature gaps to be handled through the authenticated sidecar store. Missing sidecar data continues to fail closed, and the portal reports the active risk source.

Closes #26

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 71cc0af5-8229-461b-ae4c-54131b1bd6c7
@brandwe
Brandon Werner (brandwe) merged commit ab39fb5 into main Sep 1, 2026
11 checks passed
@brandwe
Brandon Werner (brandwe) deleted the fix/26-unlicensed-risk-fallback branch September 1, 2026 22:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Deploy and validate the Azure-only enforcement stack

1 participant