Engineering portfolioMICROSOFT OPEN SOURCE

PRODUCTION ENGINEERING

Fail-Closed Approval Governance in Microsoft’s Agent Governance Toolkit

An independent open-source contribution to Microsoft’s Agent Governance Toolkit that made zero-required-stage approval chains deny by default, aligned policy behavior across implementations, and added focused regression protection.

Role

Policy evaluation
Security invariants
Regression testing
Cross-implementation parity
Open-source engineering

System challenge

An approval chain configured with zero required stages could satisfy a general set-containment condition because the empty set is a subset of every set. In a governance path, that mathematically valid result created an undesirable fail-open edge case: an optional non-advisory ALLOW result could influence authorization even though no meaningful required approval stage existed.

Constraints

Working within real limits

✕Preserve valid approval behavior for correctly configured chains
✕Treat incomplete or ambiguous policy configuration as denied
✕Keep the implementation focused enough for upstream review
✕Verify stored resolution, request state, and execution authorization—not only a local return value
✕Maintain behavioral parity with the toolkit’s intended cross-language approval semantics

Architecture

System design

Approval ChainRequired stages may be empty

Validate invariant

Required-Stage GuardReject zero-stage configuration

Only valid chains continue

Policy EvaluatorEvaluate completed required stages

Persist decision

Stored ResolutionRemains denied

Denied

Execution GateAuthorization withheld

Approval ChainRequired stages may be empty

Validate invariant

Required-Stage GuardReject zero-stage configuration

Only valid chains continue

Policy EvaluatorEvaluate completed required stages

Persist decision

Stored ResolutionRemains denied

Denied

Execution GateAuthorization withheld

Primary flow

Restricted path

External dependency

Data path

Approach

How it was built

01
Reproduced the boundary condition with an approval chain containing zero required stages and an optional non-advisory ALLOW decision.
02
Traced the decision path to an empty-set containment check and identified vacuous truth as the source of the incorrect authorization signal.
03
Introduced an explicit guard that denies chains with zero required stages before general completion logic is evaluated.
04
Kept the policy rule fail closed: an invalid requirement set cannot authorize resolution or execution.
05
Added regression coverage across the persisted resolution, associated request, and execution state.
06
Validated the focused patch and submitted it for upstream human review.

Workflow

Implementation flow

Reproduce empty-stage chain

Trace vacuous truth condition

Enforce explicit fail-closed guard

Verify resolution and request state

Verify execution remains denied

Submit for upstream review

Technical validation

Implementation evidence

Observable engineering evidence. Discipline: PRODUCTION ENGINEERING

Upstream status

Merged by Microsoft maintainer

Human review

Approved

Pull request

Microsoft #3448

Focused tests

26 passed

Patch scope

2 files · +57 / −3

Security invariant

Zero required stages → deny

Verified state path

Resolution · request · execution

Public evidence

Review the upstream contribution

View merged Microsoft pull request #3448 Explore Microsoft Agent Governance Toolkit Read the Ribbsaeter Systems case study View Patrick Ribbsaeter on GitHub

Outcome

What was delivered

Eliminated the zero-required-stage fail-open edge case in the Python approval evaluator
Made the authorization invariant explicit: no required approval stages means no authorization
Added regression protection across resolution, request, and execution state
Passed 26 focused tests with a two-file, +57 / −3 patch
Received human maintainer approval and was merged into Microsoft’s upstream repository

Technologies

Stack and tools

PythonPolicy evaluationAuthorizationAI governanceSet theoryRegression testingCross-language parityOpen-source engineering

Next engineering system

PRIVATE AI INFRASTRUCTURE

Private AI Inference & Gateway Reliability

Have an ambitious AI system to build?

Let’s build something serious.

I work across AI architecture, product engineering, private inference, automation, SaaS infrastructure, and production hardening.

Discuss a project Connect on LinkedIn Technical profile