feat(security): deterministic ActionBoundary & hash-chained action ledger for agent tools

[Ahmed Hassan (AAH20)]

Summary

Adds ActionBoundary, ActionGate, and ActionLedger to autogen_core.security to provide deterministic execution boundaries, non-destructive simulation fallbacks, and append-only SHA-256 hash-chained compliance action ledgers for Microsoft AutoGen agent tools and workbenches.

Problem Solved

When autonomous agent swarms in Microsoft AutoGen execute tools or workbench actions against cloud resources, databases, and APIs, treating LLM output confidence as execution authorization introduces acute operational risks (un-gated state mutations, rogue agent loops) and enterprise compliance blockers (failing SOC 2 Type II, ISO 42001, and NIST AI RMF audit controls).

This contribution enforces:

1. Never Equate Intent to Approval: Model confidence does not authorize mutating or high-blast operations.
2. Deterministic Tool Classification: Automatically categorizes tools into READ, WRITE_IDEMPOTENT, WRITE_MUTATING, and DESTRUCTIVE.
3. Simulation Fallback: Unapproved writes execute in safe simulation mode (simulation_mode: True) without performing unintended state mutations.
4. Cryptographic Action Ledger: Emits append-only SHA-256 hash-chained JSONL records (receipt_hash) linking previous hashes for verifiable auditability.
5. Atomic Kill-Switch: Real-time agent execution freeze (AAG_KILL_SWITCH=1 or artifacts/KILL).

Testing & Validation

• Added python/packages/autogen-core/tests/test_action_gate.py verifying:
  • Read tools allowed by default.
  • Unapproved mutating writes downgraded to simulation.
  • Prove-token authorization for mutating and destructive tools.
  • Destructive tool denial without prove tokens.
  • Kill-switch activation blocking all execution.
  • SHA-256 hash-chain integrity verification across chained actions.
  • ActionBoundary wrapper decorator behavior.
• Verified all 10 unit tests pass cleanly.

Upstream & Commercial Context

Maintained by A2Z SOC for enterprise AI runtime governance and compliance audit readiness.

For teams deploying autonomous AutoGen agent swarms requiring AI safety audits or ISO 42001 / SOC 2 readiness sprints:

• Instant Audit ($499): https://a2zsoc.com/productized-services#instant-audit-tripwire
• Consultation & AI Governance Sprints: https://a2zsoc.com/consultation