docs(guardrails): drop the stale connection-id line from the BYOG middleware - #1033
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the UiPathByoGuardrailMiddleware docstring to remove a stale reference to an Integration Service connection_id and align the description with the current BYOG configuration behavior (validator selected by name; connection resolved server-side).
Changes:
- Reworded the class docstring to state the middleware references the BYOG configuration purely by
validator_name(unique per tenant). - Clarified that the Integration Service connection is resolved server-side from the configuration, so admin rebinds are honored.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
valentinabojan
approved these changes
Aug 12, 2026
…dleware AL-510 removed `connection_id` from `UiPathByoGuardrailMiddleware` — the signature, the example, and the `Args` entry all went — but the class docstring's opening paragraph still told readers the middleware references the configuration "by its validator name and (recommended) Integration Service connection id". `git blame` puts that line on 7f4315f, before the removal; it now contradicts the `Args` block a few lines below it ("resolved server-side") and describes a parameter the constructor no longer accepts. Reword it to match the wording already used by the core `ByoValidator` docstring: the name is unique per tenant and the connection is resolved server-side from the configuration, so an admin rebind is always honored. Docstring only — no signature or behavior change.
apetraru-uipath
force-pushed
the
fix/byog-docstring-connection-id
branch
from
August 12, 2026 09:08
f4e532f to
fa859b2
Compare
apetraru-uipath
enabled auto-merge (squash)
August 12, 2026 09:08
|
Merged
1 task
apetraru-uipath
added a commit
to UiPath/skills
that referenced
this pull request
Aug 12, 2026
…-513] Bring-your-own guardrails (BYOG) let a tenant serve a validator from its own external provider — Azure AI Content Safety, Databricks, a custom connector — instead of UiPath's built-in implementation. An admin registers the configuration; agents then reference it by name. None of the agent-authoring side was documented. This covers it for both agent types, plus review and troubleshooting, and adds tests for the thread users actually hit: adding a BYOG guardrail to an agent they already have. Docs - lowcode/guardrails.md: BYO section — `Validator` is not unique once a BYOG configuration exists (a tenant sees two `pii_detection` entries, one built-in and one BYO, disambiguated by `IsByo`), the `--byo` filter, the extra `Byo*` fields, and how to pin a guardrail with `byoValidatorName`. - coded/guardrails.md: the section was previously a gate with the API left unresolved — it named no class and told the agent to stop and report BYO unavailable, which now reads as a false negative. It carries an availability table (`UiPathByoGuardrailMiddleware` is LangChain-adapter only; `ByoValidator` is a CORE class re-exported by the adapter, so BYO is not LangChain-only), worked examples for both styles with source-verified signatures, and the wire format both emit: `validatorType: "byo"` plus `byoValidatorName` — the same field low-code pins with, so the two halves converge. Critical Rule 18 rewritten; pointers added from the Middleware and Decorator style sections. - Both recommend files: key validator lookups on `(Validator, IsByo)`, not `Validator` alone, or a same-named built-in and BYO entry collide and correctness checks read the wrong entry's `Parameters`/`AllowedScopes`. Default recommendations to the built-in unless the user asks for BYO. - uipath-review (both guardrail files): the same disambiguation, plus `Status: Disabled` on a BYO entry is a tenant configuration switch, not a schema defect — don't re-diagnose it as one. - uipath-troubleshoot: BYOG as a cause of a guardrail violation, how to cross-check configuration health, and the resolution path for a disabled configuration or dead connection. Corrections found while writing the above - `byoConfigurationId` was never a real authoring field; `ByoValidatorName` is what both low-code and coded agents reference. Swept everywhere. - Dropped the last "the BYO construct carries a connection id" claim, which contradicted the same file, Rule 18, and the review skill. No connection id exists in either API — the platform resolves it server-side. - coded/guardrails.md claimed middleware never accepts `stage=`. Source shows five do (PII, harmful content, LLM-as-judge, deterministic, BYO); only the three fixed-stage validators don't. Pre-existing bug, corrected in place. Tests — adding BYOG to an existing agent Three tasks, all editing a pre-built fixture with no scaffolding graded, so the score reflects only the BYOG wiring: - lowcode byog_pinning: pins `byoValidatorName` in the shared WebResearchBriefingSolution fixture's agent.json. A selective `uip` shim (mock_path_dirs, the ixp mock pattern) serves discovery with a BYO entry alongside the same-named built-in, forcing the `IsByo` disambiguation the skill teaches; every other `uip` command passes through to the real CLI. Mocking discovery is what removes the tenant dependency entirely — no feature flag, no fixture registration, no create-time connection probe. - coded byog_middleware / byog_decorator: `UiPathByoGuardrailMiddleware` and `ByoValidator` on the SimpleCodedAgent fixture, mirroring the existing pii_middleware / user_prompt_attacks_decorator pair. Both assert the adapter import — the failure BYO is most exposed to, because `ByoValidator` genuinely lives in `uipath.platform.guardrails`, making a wrong-but-plausible import easy to land. Both carry `disallowed_tools: ["Task"]` for that reason. All three tagged `lifecycle:edit`: they edit an existing agent rather than scaffolding one. Verification - AST checkers validated against 14 controls — 4 positive (inline and variable middleware spread; positional and keyword validator name) and 10 negative (built-in substituted for BYO, wrong name, wrong action, non-factory decoration target, wrong import module, unparseable source). Every negative fails at the intended assertion. - Two-model runs green: byog_middleware 1.000 on claude-sonnet-5 (181s) and gpt-5.6-terra (196s); byog_decorator 1.000 on both (362s / 150s); byog_pinning 1.000 on both (86s / 132s). Generated artifacts inspected in each run rather than trusting the score. - `check-cli-verbs.py` and `check-task-driver.py` clean. Depends on two upstream docs fixes, both merged: UiPath/uipath-python#1854 adds the missing `ByoValidator` section to the core guardrails page (its absence is what made BYO look LangChain-only), and UiPath/uipath-langchain-python#1033 drops a stale docstring line telling readers to pass a connection id that the constructor no longer accepts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
apetraru-uipath
added a commit
to UiPath/skills
that referenced
this pull request
Aug 12, 2026
…-513] (#2516) Bring-your-own guardrails (BYOG) let a tenant serve a validator from its own external provider — Azure AI Content Safety, Databricks, a custom connector — instead of UiPath's built-in implementation. An admin registers the configuration; agents then reference it by name. None of the agent-authoring side was documented. This covers it for both agent types, plus review and troubleshooting, and adds tests for the thread users actually hit: adding a BYOG guardrail to an agent they already have. Docs - lowcode/guardrails.md: BYO section — `Validator` is not unique once a BYOG configuration exists (a tenant sees two `pii_detection` entries, one built-in and one BYO, disambiguated by `IsByo`), the `--byo` filter, the extra `Byo*` fields, and how to pin a guardrail with `byoValidatorName`. - coded/guardrails.md: the section was previously a gate with the API left unresolved — it named no class and told the agent to stop and report BYO unavailable, which now reads as a false negative. It carries an availability table (`UiPathByoGuardrailMiddleware` is LangChain-adapter only; `ByoValidator` is a CORE class re-exported by the adapter, so BYO is not LangChain-only), worked examples for both styles with source-verified signatures, and the wire format both emit: `validatorType: "byo"` plus `byoValidatorName` — the same field low-code pins with, so the two halves converge. Critical Rule 18 rewritten; pointers added from the Middleware and Decorator style sections. - Both recommend files: key validator lookups on `(Validator, IsByo)`, not `Validator` alone, or a same-named built-in and BYO entry collide and correctness checks read the wrong entry's `Parameters`/`AllowedScopes`. Default recommendations to the built-in unless the user asks for BYO. - uipath-review (both guardrail files): the same disambiguation, plus `Status: Disabled` on a BYO entry is a tenant configuration switch, not a schema defect — don't re-diagnose it as one. - uipath-troubleshoot: BYOG as a cause of a guardrail violation, how to cross-check configuration health, and the resolution path for a disabled configuration or dead connection. Corrections found while writing the above - `byoConfigurationId` was never a real authoring field; `ByoValidatorName` is what both low-code and coded agents reference. Swept everywhere. - Dropped the last "the BYO construct carries a connection id" claim, which contradicted the same file, Rule 18, and the review skill. No connection id exists in either API — the platform resolves it server-side. - coded/guardrails.md claimed middleware never accepts `stage=`. Source shows five do (PII, harmful content, LLM-as-judge, deterministic, BYO); only the three fixed-stage validators don't. Pre-existing bug, corrected in place. Tests — adding BYOG to an existing agent Three tasks, all editing a pre-built fixture with no scaffolding graded, so the score reflects only the BYOG wiring: - lowcode byog_pinning: pins `byoValidatorName` in the shared WebResearchBriefingSolution fixture's agent.json. A selective `uip` shim (mock_path_dirs, the ixp mock pattern) serves discovery with a BYO entry alongside the same-named built-in, forcing the `IsByo` disambiguation the skill teaches; every other `uip` command passes through to the real CLI. Mocking discovery is what removes the tenant dependency entirely — no feature flag, no fixture registration, no create-time connection probe. - coded byog_middleware / byog_decorator: `UiPathByoGuardrailMiddleware` and `ByoValidator` on the SimpleCodedAgent fixture, mirroring the existing pii_middleware / user_prompt_attacks_decorator pair. Both assert the adapter import — the failure BYO is most exposed to, because `ByoValidator` genuinely lives in `uipath.platform.guardrails`, making a wrong-but-plausible import easy to land. Both carry `disallowed_tools: ["Task"]` for that reason. All three tagged `lifecycle:edit`: they edit an existing agent rather than scaffolding one. Verification - AST checkers validated against 14 controls — 4 positive (inline and variable middleware spread; positional and keyword validator name) and 10 negative (built-in substituted for BYO, wrong name, wrong action, non-factory decoration target, wrong import module, unparseable source). Every negative fails at the intended assertion. - Two-model runs green: byog_middleware 1.000 on claude-sonnet-5 (181s) and gpt-5.6-terra (196s); byog_decorator 1.000 on both (362s / 150s); byog_pinning 1.000 on both (86s / 132s). Generated artifacts inspected in each run rather than trusting the score. - `check-cli-verbs.py` and `check-task-driver.py` clean. Depends on two upstream docs fixes, both merged: UiPath/uipath-python#1854 adds the missing `ByoValidator` section to the core guardrails page (its absence is what made BYO look LangChain-only), and UiPath/uipath-langchain-python#1033 drops a stale docstring line telling readers to pass a connection id that the constructor no longer accepts. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
One-line docstring fix in
src/uipath_langchain/guardrails/middlewares/byo.py.Why
AL-510 removed
connection_idfromUiPathByoGuardrailMiddleware— the signature, the example, and theArgsentry all went — but the class docstring's opening paragraph still says the middleware references the configuration:git blameputs that line on7f4315f8, before the removal. It now:Argsblock a few lines below ("the Integration Service connection to use is resolved server-side"), andconnection_id=...and getsTypeError.The fix
Reworded to match the phrasing the core
ByoValidatordocstring already uses — name unique per tenant, connection resolved server-side, admin rebind always honored.Docstring only — no signature or behavior change. Swept the rest of
guardrails/for other connection-id references: none remain (thebyo_connection_idhits elsewhere in the package are BYO LLM chat/embeddings, a separate feature that legitimately uses connection ids).Counterpart docs fix in core: UiPath/uipath-python#1854.