You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We reviewed changes in dff8828...9a7ffc1 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Distinct audit decisions can still be dropped, tool denials can show unrelated workflow grants, the primary gateway omits cache status, and Drive resource checks can break file reads and summaries.
Updates the three agent demos to Agent Gateway 2.0.3 and aligns provisioning, deployment configuration and audit displays with its admission and capability checks.
Changes:
Switches gateway images and updates endpoint, token-forwarding and cache settings.
Adds authorization policies and token-introspection configurations for the new gateway behavior.
Updates audit displays, agent guidance, documentation and Bruno assertions.
File
Description
instant-stack/README.md
Documents gateway policies and token audiences.
instant-stack/data/insurance/manifest.json
Adds admission, capability and token-introspection configurations.
instant-stack/data/ibac/manifest.json
Adds capability, profile and weather policies.
instant-stack/data/canbank/manifest.json
Adds admission, capability and token-introspection configurations.
a2a/intent-ibac-gateway/README.md
Updates release, forwarding and cache guidance.
a2a/intent-ibac-gateway/iag-base-docker.yaml
Configures published image, forwarding and card caching.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Restricted workflow grants allow an authorization bypass through ciq_execute, and capability denials still offer ineffective workflow-grant remediation.
Capability denials still offer ineffective workflow grants
a2a/ibac-demo/chatbot/static/index.html:1458
The admission guard only restricts why?; both request/grant-access branches still offer workflow grants for capability denials. For example, an ERP INVOCATION denial can offer a CAN_TRIGGER grant that cannot repair a missing capability HAS edge. Make the grant bundle empty for non-admission records so neither remediation is offered.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Non-admission authorization failures still expose request/grant controls that cannot fix missing capability grants and may grant unrelated workflow access.
No open issues 🎉
1 previously missed issue
In code that hasn't changed since last review
Hide grant controls for non-admission capability records
a2a/ibac-demo/chatbot/static/index.html:1458
isAdmission guards only the explanation, so a NOT_AUTHORIZED capability invocation still offers request/grant controls. Those controls write CAN_TRIGGER workflow edges, which cannot repair a missing HAS capability grant and may grant unrelated workflows. Make grantBundle empty for non-admission records to suppress both controls.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
implement ENG-9648