v1.3.0 — Human Approval Lifecycle

Agentic Security Framework Lab v1.3.0

Human Approval Lifecycle release: governed mutable actions now treat human approval as bounded, single-use, revocable, source-isolated authority with process-local concurrency safety.

Highlights

• Human approval evidence requires timezone-aware approved_at and expires_at timestamps.
• GovernedActionRuntime enforces the half-open validity interval [approved_at, expires_at) through a trusted application clock.
• Explicit claim outcomes distinguish missing, claimed, and revoked instead of overloading absence.
• Single-use semantics prevent approval replay; invalid, temporal-failure, and executor-failure paths do not restore a claimed capability.
• Trusted pre-claim revoke_approval(approval_id) makes withdrawal explicit and sticky without letting model-controlled input override policy.
• Approval lookup is isolated by exact (caller_id, identity_source, action, resource, environment) scope.
• A wrong-source request cannot dequeue approval authority issued for another trusted identity provenance.
• One process-local synchronization boundary linearizes approval queue and lifecycle transitions under concurrent claim/revoke callers.
• Barrier-based regressions prove eight simultaneous claims transfer one capability exactly once, claim-vs-revoke admits only linearizable outcomes, and eight concurrent approval-gated runtime attempts produce one mutable execution.

Security invariants

• Model claim of approval != trusted human approval.
• Policy deny + human approval = deny.
• Valid approval time = approved_at <= trusted_now < expires_at.
• Revoked unclaimed approval = no execution.
• Same caller_id + different identity_source != same approval capability.
• One approval capability + concurrent claims <= one claimed runtime attempt.
• Consumed approval + retry = new approval required.

Evidence discipline

The v1.3 approval-lifecycle evidence is provider-free process-local/CI evidence. It does not claim durable or distributed approval storage/revocation, cross-process atomicity, multi-party approval workflow, retroactive cancellation after claim, external side-effect rollback, or transactional coupling between approval state and remote side effects.

The accepted v1.0 Phase 15 provider-backed evaluation artifacts and the v1.1/v1.2 release metadata remain unchanged.

Release-candidate validation includes 461 tests, 95.44% coverage, Pyright with zero errors, Bandit with no identified issues, pip-audit with no known non-ignored vulnerabilities, MCP base/governed/authenticated STDIO checks, and OpenTelemetry checks.

Documentation

• docs/security/GOVERNED_AGENT_ACTIONS.md
• docs/adr/0006-treat-human-approval-as-trusted-runtime-evidence.md
• CHANGELOG.md

v1.2.0 — Trusted Caller Identity

Agentic Security Framework Lab v1.2.0

Trusted Caller Identity release: authentication is established outside model-controlled action proposals, then source-aware authorization independently decides whether the authenticated caller may execute the requested mutable action.

Highlights

• ActionContext records trusted caller provenance explicitly through identity_source.
• A framework-neutral service-caller authentication boundary keeps opaque credentials separate from authorization and execution evidence.
• The controlled API-key fixture derives identity_source = api_key only after matching synthetic credential verification material.
• AuthenticatedGovernedActionRuntime composes authentication before the existing governed authorization/approval/execution runtime.
• Exact least-privilege authorization now evaluates (caller_id, identity_source, action, resource, environment) with no cross-source fallback.
• An api_key caller does not inherit authority granted to the same caller id under trusted_composition unless policy explicitly grants that source.
• A separate MCP v2 STDIO experiment receives service credential material from trusted host/process environment while the model-visible mutable Tool still accepts only resource and environment.
• Real subprocess checks cover missing credentials, invalid credentials, authenticated deny, approval-required, and exact allow paths with independently observed side effects.

Security invariants

• Credential verification != caller identity != action authorization.
• Same caller id != same authority when identity source differs.
• Host credential context != model Tool input.
• Successful authentication does not imply authorization.
• Rejected authentication never reaches mutable execution.
• Tool availability != tool authorization != tool execution.

Evidence discipline

The v1.2 trusted-identity, service-authentication, source-aware authorization, and authenticated MCP checks are provider-free local/CI evidence. This release does not claim authenticated remote MCP identity, transport-bound identity, OAuth/OIDC/JWT/mTLS, end-user authentication, production IAM or secrets management, or provider-backed mutable action execution.

The accepted v1.0 Phase 15 provider-backed evaluation bundle and the v1.1 Governed Agent Actions release remain unchanged.

Documentation

• docs/security/GOVERNED_AGENT_ACTIONS.md
• docs/MCP.md
• docs/adr/0008-separate-service-caller-authentication-from-authorization.md
• CHANGELOG.md

v1.1.0 — Governed Agent Actions

Agentic Security Framework Lab v1.1.0

Governed Agent Actions release: deterministic authorization and runtime enforcement around mutable agent actions, with trusted caller context and human approval kept outside model-controlled proposals.

Highlights

• Framework-neutral Governed Agent Actions contracts separate untrusted ProposedAction from trusted ActionContext.
• Exact least-privilege authorization evaluates (caller_id, action, resource, environment) and fails closed for unknown scope.
• allow, deny, and require_human_approval remain explicit authorization outcomes; model intent never becomes authority by itself.
• Human approval is trusted runtime evidence bound to the exact caller/action scope and is claimed as a single-use capability to prevent replay.
• LangGraph, CrewAI Flow, LlamaIndex Workflow, and Agno Workflow adapters all delegate authorization and enforcement to the shared application runtime.
• Cross-framework conformance checks compare full execution evidence and observable side effects against the direct application baseline.
• A governed mutable MCP v2 STDIO server proves that tool availability does not bypass application-owned authorization or HITL enforcement.
• Adversarial integration coverage includes caller spoofing, fake approval fields, action/resource/environment escalation, substitution, retry-after-deny, and approval replay resistance.

Security invariants

• Tool availability != tool authorization != tool execution.
• Model intent != authorization decision != runtime enforcement.
• Explicit deny is terminal; human approval cannot override deny.
• Caller identity and approval authority are trusted context, not tool/model arguments.
• A validated approval is consumed before the mutable side effect and is not automatically restored after failure.

Evidence discipline

Governed-action application, framework-adapter, adversarial, conformance, and local MCP checks in v1.1 are provider-free CI evidence. This release does not claim production certification, authenticated remote MCP identity, or provider-backed action execution.

The accepted v1.0 Phase 15 provider-backed evaluation bundle remains immutable and is not rewritten by v1.1 work.

Documentation

• docs/security/GOVERNED_AGENT_ACTIONS.md
• docs/mcp/README.md
• docs/adr/0005-framework-neutral-agent-action-authorization.md
• docs/adr/0006-human-approval-as-trusted-runtime-evidence.md
• CHANGELOG.md

v1.0.0 — Portfolio Complete

Agentic Security Framework Lab v1.0.0

First portfolio-complete release of the lab.

Highlights

• Framework-neutral Domain/Application architecture with LangGraph, CrewAI Agent/Crew, CrewAI Flow, LlamaIndex Workflow, and Agno Workflow adapters.
• Deterministic validation, bounded semantic retry, oracle fallback, and human-review policy around probabilistic reasoning.
• Centralized LiteLLM provider boundary using the governed security-analysis alias.
• MCP v2 STDIO compatibility and real subprocess smoke coverage.
• Framework-neutral, content-free logical OpenTelemetry observation contract.
• Immutable five-way Phase 15 evaluation evidence: 75 framework executions, 76 actual model calls, and 100% expected final outcomes.
• Runtime hardening for CrewAI tracing and LlamaIndex timeout/retry ownership without rewriting historical evidence.
• English and Portuguese portfolio READMEs, audience-based documentation map, executive overview, and expanded developer onboarding.

Documentation

• English: README.md
• Português (Brasil): README.pt-br.md
• Executive overview: docs/EXECUTIVE_OVERVIEW.md
• Documentation map: docs/README.md
• Development guide: docs/DEVELOPMENT.md
• Framework decision matrix: docs/FRAMEWORK_DECISION_MATRIX.md

Evidence discipline

The accepted Phase 15 evidence remains tied to commit dd48c2490fc4ec1c76093577f7944d76a6fbc572. Later runtime hardening and documentation changes do not rewrite those artifacts.

See CHANGELOG.md for the complete v1.0.0 summary.