feat: disable request/response content in custom ADK spans on Agent Engine in case there's no explicit consent

PiperOrigin-RevId: 820829272

Author: vertex-sdk-bot

tests/unit/vertex_adk/test_agent_engine_templates_adk.py

@@ -457,6 +457,26 @@ def test_enable_tracing_warning(self, caplog):
         # app.set_up()
         # assert "enable_tracing=True but proceeding with tracing disabled" in caplog.text
 
+    @mock.patch.dict(os.environ)
+    def test_span_content_capture_disabled_by_default(self):
+        app = agent_engines.AdkApp(agent=_TEST_AGENT)
+        app.set_up()
+        assert os.environ["ADK_CAPTURE_MESSAGE_CONTENT_IN_SPANS"] == "false"
+
+    @mock.patch.dict(
+        os.environ, {"OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT": "true"}
+    )
+    def test_span_content_capture_enabled_with_env_var(self):
+        app = agent_engines.AdkApp(agent=_TEST_AGENT)
+        app.set_up()
+        assert os.environ["ADK_CAPTURE_MESSAGE_CONTENT_IN_SPANS"] == "true"
+
+    @mock.patch.dict(os.environ)
+    def test_span_content_capture_enabled_with_tracing(self):
+        app = agent_engines.AdkApp(agent=_TEST_AGENT, enable_tracing=True)
+        app.set_up()
+        assert os.environ["ADK_CAPTURE_MESSAGE_CONTENT_IN_SPANS"] == "true"
+
 
 def test_dump_event_for_json():
     from google.adk.events import event

vertexai/agent_engines/templates/adk.py

@@ -575,6 +575,19 @@ def set_up(self):
         os.environ["GOOGLE_CLOUD_PROJECT"] = project
         location = self._tmpl_attrs.get("location")
         os.environ["GOOGLE_CLOUD_LOCATION"] = location
+
+        content_enabled = os.getenv(
+            "OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT", "false"
+        ).lower() in ("true", "1")
+        # Disable content capture in custom ADK spans unless:
+        # 1. User opted-in for content capture.
+        # 2. Or user enabled tracing explicitly with the old flag (this is to
+        #    preserve compatibility with old behavior).
+        if self._tmpl_attrs.get("enable_tracing") or content_enabled:
+            os.environ["ADK_CAPTURE_MESSAGE_CONTENT_IN_SPANS"] = "true"
+        else:
+            os.environ["ADK_CAPTURE_MESSAGE_CONTENT_IN_SPANS"] = "false"
+
         if self._tmpl_attrs.get("enable_tracing"):
             instrumentor_builder = (
                 self._tmpl_attrs.get("instrumentor_builder")