Repository navigation
Clarify whether remaining enforcement_mode="enforce" defaults are intentional after declared #416
Description
#143 introduced policy.enforcement_mode: "declared" for producers that bind a policy without claiming that anything evaluated it. Its follow-up noted that framework adapters could then default to declared instead of refusing to fill the field.
The announced framework-adapter follow-up landed in agentrust-io/integrations#93. At f6e8c8b, LangChain, LlamaIndex, Google ADK and OpenAI Agents default to declared.
I noticed three related code paths that still default to enforce:
packages/agentrust-trace-adapters/.../evidence.py—PolicyEvidenceTraceSandboxAdapterTraceAGTAdapter
For the two reference adapters, omission is also the documented path: the sandbox quickstart and AGT tutorial construct the adapter without supplying enforcement_mode.
One type-level detail: TraceSandboxAdapter still annotates the parameter as Literal["enforce", "advisory", "silent"]; declared is not listed there, although it currently passes through at runtime. TraceAGTAdapter types the parameter as str.
Were these three paths intentionally outside the #143 follow-up — for example because their producing context is expected to establish policy evaluation/enforcement — or is this remaining difference simply follow-up work that has not landed yet?
Filed under the bug-report template as a question about ambiguous scope rather than a defect claim. No implementation change proposed; I'm trying to establish whether the difference is intentional before treating it as a gap.
Activity
imran-siddique commentedon Sep 25, 2026
These three paths still default to enforce, and PolicyEvidence also rejects declared. They should not infer enforcement from an omitted argument.
Use declared as the evidence-constructor default across all three APIs. Callers with an established enforcement context should pass the actual mode explicitly. Keep the runtime default as enforce.
Include omission and explicit-mode tests, update the tutorials, and document the behavior change for existing callers. Keep the work to these three paths.
fix(adapters): require enforcement_mode in the AGT and sandbox adapte…
fix(adapters): default PolicyEvidence mode to declared
docs(otel-genai): include required --enforcement-mode in usage example
docs(otel-genai): include required --enforcement-mode in usage example (
imran-siddique commentedon Oct 6, 2026
@solloek369-arch closing as delivered. All three paths now take
enforcement_modewith no default:TraceAGTAdapterandTraceSandboxAdapterin #419, andPolicyEvidencein integrations at631c3c6, with the tutorials and the OTel example updated in integrations#279. That is stricter than my September 25 comment, which asked fordeclaredas the default. §4.3 saysdeclaredMUST NOT be a default, so the caller states the mode every time.