Repository navigation
feat(guardrails): give post-execution guardrails only the files the output references [AL-611] - #1144
Draft
apetraru-uipath wants to merge 1 commit into
Draft
apetraru-uipath wants to merge 1 commit into
apetraru-uipath wants to merge 1 commit into
Conversation
…utput references [AL-611] The guardrail at agent output and the guardrail after each LLM call used to receive every file in the run's attachment registry. Input uploads were judged again as if the agent had produced them, which gave the Intellectual Property guardrail false positives, and with inputs first under the five-file cap the files the agent actually produced could be dropped. Each guardrail node now takes one attachment source. The agent-output check scans the agent result, and the post-LLM check scans the tool-call arguments of the last message. Each sends only the registered files they reference. The pre-execution checks at Agent and LLM scope still send the whole registry, and the tool checks keep their behaviour on the same mechanism. The scan walks the payload in document order, so the files written first are the ones kept under the cap. Resolution now returns one of three answers. None says nothing about files: the guardrail is text only, or the payload could not be scanned, and the backend falls back to the text. An empty list says files apply and there are none, so a files-only guardrail passes without judging the text. Otherwise the list holds the files to inspect. The scope is read before the empty-registry shortcut. The 400 retry still drops the references, and a 400 on an empty list propagates. The output-file verification node also registers the references Orchestrator verified, so the agent-output check can resolve files from tools that do not register their attachments. Without a job key nothing was verified and nothing is registered. That verification runs only when output files are enabled for the agent. When it is off, a file from such a tool is not in the registry at agent output, so the check sends an empty list for it, as the full-registry send did before. A test pins that an agent-output check in Files scope with no referenced file puts an empty attachments list on the wire. It is skipped until the installed uipath-platform sends empty lists, which starts with 0.2.36. The version moves to 0.18.33. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed?
Post-execution guardrails get only the files the output references (AL-611).
agent_resultand sends only the registered files it references.end_execution.Three-way resolution:
None: text only, or the payload could not be scanned. The backend falls back to text.[]: files apply and there are none. A Files-only guardrail passes without judging the text.The 400 retry still drops the references, and a 400 on
[]propagates.Output-file verification now registers the references Orchestrator verified, so the agent-output check can resolve files from tools that don't register attachments. It does nothing without a job key.
Known limit: that verification runs only when output files are enabled for the agent, i.e. it has a Create File tool and is not conversational. Without it, a file from a tool that doesn't register attachments isn't sent at agent output.
Version 0.18.33.
How has this been tested?
attachment_refsreturns.end_execution): turn 1 sends[], turn 2 sends the file, and agent output sends only the created file, not the input."attachments": [], skipped until platform 0.2.36./validate), with an IP guardrail at Agent scope, Files, Text and an uploaded protected input file:[]and passed with no provider call, and theend_executionturn sent the file and was blocked with "Flagged files: code_sample.txt".Related (AL-611)
🤖 Generated with Claude Code