[Boyina Gowtham (moah0911)]

Related Issue

Fixes #4374

Problem & Solution

Problem. The default host policy dispatcher inspected every policy in a manifest and rejected any engine other than Rego. A Cedar policy was valid in the manifest schema and agent-control-spec already shipped CedarBuiltinDispatcher, but Python, Node and .NET hosts hit default policy dispatcher supports only Rego policies unless they wrote a dispatcher. The Python workaround was a custom PolicyDispatcher over cedarpy.

Solution. default_host_policy_dispatcher_with_limits now accepts Rego and Cedar policies. Rego invocations keep the existing OPA path, including ACS_OPA_PATH selection and bundle behavior. Cedar invocations go to the in-process agent_control_spec::CedarBuiltinDispatcher, so advice validation and fail-closed behavior come from the engine that already implements the Cedar contract. A manifest that declares both engines gets a small routing dispatcher that forwards evaluate and warm by invocation type. Manifests with test or custom policies still fail at construction because no bundled evaluator exists for them. The error message now says only Rego and Cedar.

The public API and result shape are unchanged. A host-supplied policy_dispatcher still overrides the default.

Impact on Your Work

A Cedar manifest now evaluates with no custom dispatcher on Python, Node and .NET. Rego-only manifests take the same dispatcher path as before. Hosts that need a different Cedar engine can still pass their own dispatcher.

Timeline

None.

Alternatives Considered

• Always return the routing dispatcher. Rejected. A Rego-only manifest keeps the exact dispatcher instance and behavior it had before.
• Accept test and custom policies in the default dispatcher. Rejected. There is no bundled evaluator for them, and accepting the manifest would move the failure to evaluation.
• Keep the host-dispatcher requirement for Cedar. Rejected. That is the gap this issue asks to close.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Maintenance (dependency updates, CI/CD, refactoring)
• Security fix

Package(s) Affected

Governance & security:

• agent-mcp-governance
• agent-rag-governance
• agent-sandbox
• agent-discovery
• agt-policies
• policy-engine

Shared / other:

• docs / root (CHANGELOG.md)

Other: the Python, Node and .NET SDKs under policy-engine/sdk/.

Testing

Unit Testing

New tests in policy-engine/sdk/rust/src/host/tests.rs:

• Cedar allow, deny (@id reason) and malformed advice through the default dispatcher.
• A mixed Rego and Cedar manifest that evaluates its Cedar intervention point.
• Router dispatch by invocation type and rejection of an engine with no built-in.
• A dispatcher-level check that malformed advice reports runtime_error:policy_output_invalid.

New tests in policy-engine/sdk/python/tests/test_native_runtime.py:

• Cedar allow, deny and malformed advice through AgentControl.from_native with no policy dispatcher.
• The unsupported-type error now asserts only Rego and Cedar.

New cases in policy-engine/sdk/dotnet/tests/AgentControlSpecification.Tests/Program.cs and policy-engine/sdk/node/test/native-runtime.test.mjs cover the same allow, deny and malformed-advice policies.

Manual Testing

All commands ran on Linux x86_64 with OPA 0.70.0 on ACS_OPA_PATH.

• Rust: cargo test -p agent_control_specification passed every suite (54 lib tests plus the integration suites).
• Python: pytest sdk/python passed 308 tests with 42 skipped.
• .NET: dotnet build AgentControlSpecification.sln succeeded with 0 warnings and 0 errors, and dotnet run --project tests/AgentControlSpecification.Tests passed.
• Node: npm run build:test then node --test test/native-runtime.test.mjs passed 21 tests.
• cargo fmt --all -- --check and cargo clippy -p agent_control_specification --all-targets -- -D warnings passed.
• ruff check on the changed Python test file reports no new findings. The file's 7 existing findings are unchanged.
• cspell on added lines found 0 issues. The docs link checker found 0 broken links and the frontmatter checker found 0 findings.
• The Cedar manifest in tutorial 08 validates with validate_manifest and evaluates to deny for the blocked input and allow otherwise.

The malformed-advice cases fail closed with runtime_error:policy_invocation_failed. That is the runtime's §12.3 fold of the dispatcher error. The Cedar dispatcher itself reports runtime_error:policy_output_invalid, and the Rust test asserts both layers.

Checklist

• I have linked a related issue above, or completed "Problem & Solution", "Impact on Your Work", and "Alternatives Considered"
• My code follows the project style guidelines (ruff check)
• I have added tests that prove my fix/feature works
• All new and existing tests pass (pytest)
• I have updated documentation as needed (CHANGELOG, tutorial 08, SDK READMEs)
• I have signed the Microsoft CLA

Attribution & Prior Art

• This contribution does not contain code copied or derived from other projects without attribution
• Any external projects that inspired this design are credited in code comments or documentation
• If this PR implements functionality similar to an existing open-source project, I have listed it below

The Cedar evaluator comes from the existing agent-control-spec dependency. No third-party code was added.

AI Assistance

• I can explain every meaningful change in this PR: what it does, why, and what tradeoffs were considered
• I have run tests and verification appropriate for this change
• No part of this PR was autonomously submitted by an AI agent without my review
• I have not used AI to generate review comments on others' PRs

Qoder (AI coding assistant) prepared the implementation and ran the Rust, Python, .NET and Node test suites at my request. I authorized the submission and will handle review comments.

IP, Patents, and Licensing

• This contribution does not implement patent-pending or patent-encumbered techniques
• This contribution does not require an NDA or licensing agreement to understand or use
• Any AI tools used have terms compatible with the MIT License

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

Welcome to the Agent Governance Toolkit! Thanks for your first pull request.
Please ensure tests pass, code follows style (ruff check), and you have signed the CLA.
See our Contributing Guide.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AGT Contributor Check.