Repository navigation
.Net: feat: Zero-Allocation BoundedExecutionFilter (Resolves #13661) - #14533
Open
cloudsealed wants to merge 3 commits into
Open
cloudsealed wants to merge 3 commits into
cloudsealed wants to merge 3 commits into
Conversation
semantic-kernel-automation
Bot
added
the
.NET
github-actions
Bot
changed the title
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Placeholder hashing, shift aliasing, and absent signature verification leave the security boundary ineffective.
Review effort: Balanced
Findings: 2
Open (2)
What changed in this PR
Adds a C# bounded-execution guardrail for function invocation, but does not implement the provider abstraction requested by #13661.
Changes:
- Adds a bitmask-based transition-validation engine.
- Adds a function invocation filter that blocks unauthorized transitions.
| File | Description |
|---|---|
BoundedExecutionFilter.cs |
Integrates transition checks into function invocation. |
BoundedExecutionEngine.cs |
Implements bitmask-based transition validation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| @@ -0,0 +1,32 @@ | |||
| using System.Runtime.CompilerServices; | |||
| @@ -0,0 +1,40 @@ | |||
| using System; | |||
Author
|
@microsoft-github-policy-service agree company="CloudSealed" |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
Resolves Issue #13661 (IGuardrailProvider interface for policy-based function invocation control) and introduces zero-allocation protection against Tool Hijacking.
As multi-agent architectures scale in enterprise environments, traditional LLM proxy guardrails introduce severe latency and GC spikes. This PR introduces the
BoundedExecutionFilter, a deterministic, zero-allocation guardrail implementation ofIFunctionInvocationFilter. It enforces topological boundaries directly at the auto-function invocation layer to prevent indirect prompt injections.Description
This PR introduces two components:
BoundedExecutionEngine: A low-levelreadonly structthat uses thread-local bitmasks to validate agent transitions.BoundedExecutionFilter: An implementation ofIFunctionInvocationFilterthat injects the security engine into the Semantic Kernel pipeline.BenchmarkDotNet Results (BESM vs Legacy String Validation):
Execution takes
1.3nswith 0 Bytes of heap allocation, eliminating GC spikes in high-throughput loops.Note: The formal mathematical proofs of the containment boundary implemented here were peer-reviewed and published under CloudSealed AI Security Research: Zenodo Open Access Preprint 10.5281/zenodo.23114296.
Contribution Checklist