Skip to content

test: add OTEL span content leakage integration tests#485

Merged
jesseturner21 merged 7 commits into
mainfrom
feat/otel-no-user-content-tests
May 19, 2026
Merged

test: add OTEL span content leakage integration tests#485
jesseturner21 merged 7 commits into
mainfrom
feat/otel-no-user-content-tests

Conversation

@jesseturner21
Copy link
Copy Markdown
Contributor

@jesseturner21 jesseturner21 commented May 19, 2026

Summary

  • Adds integration tests that assert user content (prompts, agent responses) never appears in OTEL spans
  • COE Finding: prevents user content from leaking into observability backends via span attributes/events
  • Tests use sentinel strings sent through the full request lifecycle, then verify absence from all exported span data

Test cases

  • test_sync_invocation_no_user_content_in_spans — standard JSON request/response
  • test_streaming_invocation_no_user_content_in_spans — async generator streaming
  • test_a2a_message_send_no_user_content_in_spans — A2A protocol (skips if a2a-sdk not installed)
  • test_ag_ui_no_user_content_in_spans — AG-UI protocol (skips if ag-ui not installed)

Test plan

  • All tests pass locally (2 pass, 2 skip due to optional deps)
  • CI passes with full dependency matrix

@jesseturner21
test: add integration tests asserting no user content in OTEL spans
6e95fae 
COE Finding: User prompts and agent responses must never leak into exported
OTEL span attributes, events, or resource attributes. These tests send
requests with unique sentinel strings through the full request lifecycle
and verify they are absent from all exported span data.

Covers: BedrockAgentCoreApp (sync + streaming), A2A, AG-UI.
@jesseturner21 jesseturner21 requested a review from a team May 19, 2026 17:40
@jesseturner21 jesseturner21 merged commit c311682 into main May 19, 2026
35 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Hweinstock Hweinstock Hweinstock approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jesseturner21 @Hweinstock