Microsoft Agent Framework — FIDES security subsystem

Claim

Whether FIDES supports its public characterization as a deterministic prompt-injection defense in which tool calls are policy-checked and security guarantees are verifiable.

Relationship and independence declaration

The target repository is controlled by Microsoft. DDCAL used public read-only source evidence and made no target changes. This statement is assessment-specific and is not a blanket organizational-independence claim.

Scope

The FIDES security module, its security tests, ADR 0024, implementation summary, core package metadata, and DDCAL synthetic runtime probes of enforcement, confidentiality and label precedence.

Exclusions

Model-provider behavior, hosted deployments, remote MCP servers, training-data poisoning, formal proof construction/checking and modules outside the defined FIDES boundary.

Findings

F1 — Expected enforcement path

PASS. An UNTRUSTED-context effectful tool call was blocked before execution when the required context label was present.

F2 — Confidentiality downgrade

PASS. PRIVATE-labeled data was rejected for a PUBLIC destination.

F3 — Adverse: missing security context fails open

HIGH. The controlled probe reproduced execution when context_label metadata was absent. The middleware warns and continues instead of failing closed. This materially narrows the claim that all tool calls are policy-checked.

F4 — Adverse: declared source integrity can override untrusted input taint

MEDIUM. The probe reproduced a TRUSTED result label from an UNTRUSTED input when the tool declared source_integrity=trusted. Integrity non-downgrade is therefore configuration-sensitive.

F5 — Limitation: formal-guarantee language not established

MATERIAL. The ADR is marked proposed, the assessed FIDES classes are experimental, and no formal proof artifact was established within scope.

Unresolved findings

• Middleware ordering across every supported integration path.
• Trust assumptions for external MCP-provided IFC labels.
• End-to-end resistance across the full prompt-injection attack space.

Limitations and uncertainty

One immutable revision only; not certification; no absence-of-vulnerabilities claim; no future-version generalization. Uncertainty is moderate.

Conclusion

CLAIM PARTIALLY SUPPORTED — MATERIAL ADVERSE FINDINGS. FIDES implements real deterministic label and policy mechanisms with demonstrated blocking behavior under defined conditions. This assessment does not support an unconditional claim that all tool calls are always policy-checked or that formally verified prompt-injection resistance has been established.

Public evidence

Machine-readable evidence bundle →