docs(learn): add tool-call gating with Tessera (multi-agent example)#5627
Draft
kenithphilip wants to merge 2 commits intocrewAIInc:mainfrom
Draft
docs(learn): add tool-call gating with Tessera (multi-agent example)#5627kenithphilip wants to merge 2 commits intocrewAIInc:mainfrom
kenithphilip wants to merge 2 commits intocrewAIInc:mainfrom
Conversation
Adds a Learn how-to page introducing [Tessera](https://github.com/kenithphilip/Tessera), an Apache-2.0 library that gates sensitive tool calls in multi-agent crews when the active context contains untrusted segments (the canonical OWASP Agentic ASI01 indirect-prompt- injection vector). The page walks through the canonical injection scenario in a multi-agent setup: - Researcher agent fetches a hotel review URL via fetch_url (output labelled UNTRUSTED). - Planner agent consumes the research output and tries to invoke book_hotel. - An attacker-controlled page contains an injection that asks the planner to book a different hotel. Without a guard, the planner's LLM follows the injection. With TesseraCrewCallback wired as step_callback, book_hotel is denied because the active context's min_trust is below the policy's USER floor. Includes the wiring (Agent / Task / Crew / step_callback) and links to a runnable end-to-end demo at examples/crewai_multi_agent_gated.py in the Tessera repo. Adds the page to the en/learn nav across the multi-tab docs config (10 group entries). No CrewAI code changes; documentation only. Signed-off-by: Kenith Philip <kennethpallota@gmail.com>
kenithphilip
added a commit
to kenithphilip/Tessera
that referenced
this pull request
Apr 26, 2026
Companion to the upstream CrewAI docs PR (crewAIInc/crewAI#5627). Demonstrates the canonical OWASP Agentic ASI01 failure mode in a multi-agent crew: - Researcher fetches a hotel review URL (output labelled UNTRUSTED). - Planner consumes the research and tries book_hotel. - Poisoned page injects an instruction to book a different hotel for far more nights. - TesseraCrewCallback denies book_hotel because the active context's min_trust is UNTRUSTED, below the policy's USER floor for that tool. Synthetic-policy fallback path runs when crewai is not installed, so the example stays exercisable in environments without the optional [crewai] extra (verified locally: prints POLICY_DENY with the right reason and exits 0).
5 tasks
Two lint fixes: - E401: split 'import os, secrets' into separate lines. - F821: replace _do_fetch / _do_book references with self- contained inline returns so the example imports cleanly with just the documented dep pins. Signed-off-by: Kenith Philip <kennethpallota@gmail.com>
Author
|
Tangentially: Tessera (the upstream library this PR introduces a callback for) is recruiting 2 co-maintainers from any other organisation as the gate for an OpenSSF Sandbox application. If anyone reviewing this PR or active in the repo's community is interested, the public ask is at |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a Learn how-to page introducing Tessera, an Apache-2.0 library that gates sensitive tool calls in multi-agent crews when the active context contains untrusted segments. CrewAI's multi-agent flow is one of the canonical scenarios where indirect prompt injection (OWASP Agentic ASI01) compounds across delegation; Tessera's per-segment provenance gives the crew an automatic floor.
Why this PR is here now
A previous draft of this PR was held back because the example needed to demonstrate the multi-agent failure mode end-to-end, not just the single-agent wiring. This PR ships:
examples/crewai_multi_agent_gated.pyin the Tessera repo: a Researcher + Planner crew with a poisoned page served by a local stub. Demo verified locally to emitPOLICY_DENYfor the injectedbook_hotel(name='Cabo Resort', nights=30)while allowing the user-requestedbook_hotel(name='The Plaza', nights=2).docs/en/learn/tool-call-gating-with-tessera.mdxpage (~150 lines) that walks through the same scenario.What this adds
docs/en/learn/tool-call-gating-with-tessera.mdx(new page).docs/docs.json(one per tab variant). Surgical regex edit; the file is otherwise unchanged.Test plan
tests/test_crewai_adapter.py.python3 -c "import json; json.load(open('docs/docs.json'))"validates the docs.json after the surgical regex edit.Why draft
First downstream-introduction PR from Tessera; submitting as draft so the CrewAI docs maintainers can guide on placement (Learn vs. Observability vs. Concepts), tone, or whether to fold this into an existing security-related page.
DCO sign-off applied per the Tessera contribution policy.