security: egress and Foundry API responses lack content validation

[imran-siddique]

Summary

Two related gaps in output validation:

1. Foundry API requests bypass domain blocklist (routes.rs:815-836) — blocklist checks the upstream endpoint domain, but the agent controls the project ID and resource paths. An agent could access unauthorized datasources via /knowledgebases/{evil-kb}/search.

2. Egress fetch responses returned unvalidated (routes.rs:1836-2017) — response body is capped at 2MB but no content inspection. An allowlisted domain could return malicious payloads (script injection, oversized JSON, binary exploits).

Proposed Fix

For Foundry API: Validate request body before proxying:

if let Some(datasource) = req_body.get("datasource_id") {
    if !policy.is_approved_datasource(datasource) {
        return Err("Datasource blocked by policy");
    }
}

For egress fetch: After receiving response, validate content:

let body = resp.bytes().await?;
validate_response_content(&body, expected_content_type)?;
// Check: max nesting depth, no embedded scripts, size within policy

AGT's output validation middleware handles both patterns.

References

• routes.rs lines 815-836 (foundry_proxy)
• routes.rs lines 1836-2017 (egress_fetch)

[pallakatos]

Resolved in main (merge commit 8f90e58)

LLM responses are validated against AGT policy in a fire-and-forget async task (non-blocking to latency).

Implementation: inference-router/src/routes.rs lines 563–603

// Fire-and-forget — response returned immediately, validation runs async
tokio::spawn(async move {
    let eval_body = serde_json::json!({
        "action": format!("output:{}", response_text),
        "agent_id": sandbox,
        "context": { "response_length": response_text.len() }
    });
    match sidecar.forward("POST", "/evaluate", Some(&eval_body)).await {
        Ok((s, json)) if s == 403 => {
            tracing::warn!("AGT: model response flagged by output policy");
        }
    }
});

Extracts choices[0].message.content from response body, evaluates against response-content-safety policy rule.

Key commit: dd6b948 (Wire response validation #9)