security: inference requests bypass policy evaluation entirely (CRITICAL)

[imran-siddique]

Summary

The primary inference path (/v1/chat/completions, /v1/completions) does not call governance policy evaluation before forwarding to the model. Additionally, the /agt/evaluate endpoint is a stub that returns Allow for everything.

Details

Gap 1 — routes.rs:989 (agt_evaluate): The policy evaluation endpoint accepts any action and returns Allow. No actual policy file is loaded or evaluated.

Gap 2 — routes.rs:332-503 (chat_completions): Requests flow through Content Safety → token budget → proxy. There is no governance.evaluate_action() call. A policy that says "block reasoning_model requests in training mode" or "require approval for 100k+ token generations" would never fire.

Impact

This is the most critical gap — the entire inference path has zero policy enforcement. All 708 lines of governance.rs exist but are never invoked on the primary code path.

Proposed Fix (once AGT Rust SDK exists)

After Content Safety checks and before proxying, add:

let decision = governance.evaluate_action(&format!(
    "inference:{}:{}", model, estimated_tokens
)).await;
match decision {
    PolicyDecision::Deny(reason) => return forbidden(reason),
    PolicyDecision::RequiresApproval(_) => return pending_approval(),
    _ => {} // proceed
}

Also, load actual YAML policy from the ConfigMap mount at startup (controller already creates the mount).

References

• routes.rs lines 332-503, 973-1018
• governance.rs evaluate_action() function
• Related: feat: Rust SDK crate (agentmesh-rust) for native integration with Rust agent platforms microsoft/agent-governance-toolkit#556 (Rust SDK)

[pallakatos]

Resolved in main (merge commit 8f90e58)

All inference requests are evaluated against AGT policy via the sidecar before forwarding to Azure OpenAI.

Implementation: inference-router/src/routes.rs lines 414–436

if state.sidecar.enabled {
    let eval_body = serde_json::json!({
        "action": format!("inference:chat_completions:{}", model),
        "context": { "sandbox": sandbox_name, "model": model }
    });
    match state.sidecar.forward("POST", "/evaluate", Some(&eval_body)).await {
        Ok((status, json)) if status == 403 => {
            // Returns 403 to caller — inference blocked by policy
        }
    }
}

Action format: inference:chat_completions:{model} — allows per-model policy rules.

Verified on AKS: 13 audit entries showing inference:chat_completions:gpt-4.1 with decision=allow.

Key commit: c53122f (Phase 2: wire inference + spawn)