[mhatipog]

Motivation

Addresses the documented quarantine-client ownership limitation in #7455 (C2).

SecureAgentConfig accepts a per-agent quarantine client, but quarantined_llm selects a process-global client. Multiple agents running in one process can therefore route quarantine content through another agent's configured client.

Changes

• Bind the quarantine client to its owning security middleware, including an explicit None.
• Use the active task-local middleware to select the correct client.
• Preserve the existing global fallback for standalone tool invocations.
• Add regression coverage to Microsoft's existing security test suite.

Validation

• Red/green proof: The new test fails on unmodified upstream code and passes after the fix.
• Compatibility: Python 3.11, 3.12 and 3.13 passed.
• Additional checks: Microsoft's security suite and Ruff lint passed.

[Red/green evidence](https://github.com/mhatipog/oai/actions/runs/38857349168) · [Cross-version CI](https://github.com/mhatipog/oai/actions/runs/38857349282)

This is a focused fix for an already documented limitation, not a claim of a newly discovered vulnerability.

Related: #7455 and the earlier unmerged PR #7528.

[Copilot]

🟡 Changes recommended

Replacing a supported label tracker loses the client binding and restores cross-configuration routing.

1 open finding

• Bind replacement tracker to its owning config's quarantine client · New

What changed in this PR

Addresses #7455 C2 by routing quarantine calls through the owning security configuration.

Changes:

• Binds quarantine clients, including None, to label-tracking middleware.
• Preserves the global fallback for standalone calls.
• Adds regression coverage and updates ownership documentation.

File	Description
python/​packages/​core/​tests/​test_security.py	Tests client isolation, missing clients, and standalone fallback.
python/​packages/​core/​agent_framework/​security.py	Adds middleware-bound client selection and updates documentation.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[mhatipog]

Updated the branch against the latest main. No merge conflicts, and the diff is still limited to the original two files.

The CI workflows are showing "action_required". Could a maintainer approve the runs so we can get the PR validated?

Thanks!

[Copilot]

🟢 Approval recommended

The focused implementation covers scoped and direct middleware use, with regression coverage for the previously reported replacement-tracker gap and no unresolved blocking findings.

No open issues 🎉

1 resolved since last review

• Bind replacement tracker to its owning config's quarantine client

_{Review effort: Balanced}