[python] PoC: AI Guard test under INTEGRATION_FRAMEWORKS by avara1986 · Pull Request #7257 · DataDog/system-tests

avara1986 · 2026-07-03T12:34:56Z

What

Proof-of-concept exploring whether AI Guard coverage can be consolidated under the INTEGRATION_FRAMEWORKS scenario instead of the dedicated AI_GUARD scenario.

Adds tests/integration_frameworks/llm/openai/test_openai_ai_guard.py, which drives AI Guard evaluation through the OpenAI framework weblog using the test_client/test_agent fixtures, and asserts on the ai_guard span (meta.ai_guard.*, meta_struct.ai_guard) — reusing the payloads and span shape from tests/ai_guard/test_ai_guard_sdk.py.

Status: DRAFT / investigation

This is a scaffold for the investigation tracked in APPSEC-68977. It is not runnable yet — it depends on prerequisites still to be validated:

an /ai_guard/evaluate endpoint in utils/build/docker/python/openai_app/openai.py that calls the tracer's AI Guard client;
the test-agent VCR proxy serving an /vcr/aiguard upstream (or reusing the standalone VCRCassettesContainer);
DD_AI_GUARD_ENABLED / DD_AI_GUARD_ENDPOINT wired into IntegrationFrameworksScenario.

Jira

Investigation task: https://datadoghq.atlassian.net/browse/APPSEC-68977 (under epic APPSEC-68823)

🤖 Generated with Claude Code

github-actions · 2026-07-03T12:35:29Z

CODEOWNERS have been resolved as:

tests/integration_frameworks/llm/openai/test_openai_ai_guard.py         @DataDog/ml-observability
tests/integration_frameworks/utils/vcr-cassettes/aiguard/test_before_model_validation_aiguard_evaluate_post_ca44130a.json  @DataDog/system-tests-core
tests/integration_frameworks/utils/vcr-cassettes/aiguard/test_before_model_validation_aiguard_evaluate_post_d13cc790.json  @DataDog/system-tests-core
tests/integration_frameworks/utils/vcr-cassettes/aiguard/test_tool_call_validation_aiguard_evaluate_post_9e556a11.json  @DataDog/system-tests-core
tests/integration_frameworks/utils/vcr-cassettes/aiguard/test_tool_call_validation_aiguard_evaluate_post_a304603c.json  @DataDog/system-tests-core
tests/integration_frameworks/utils/vcr-cassettes/openai/test_before_model_validation_openai_chat_completions_post_eb8df755.json  @DataDog/system-tests-core
tests/integration_frameworks/utils/vcr-cassettes/openai/test_tool_call_validation_openai_chat_completions_post_f2dffea2.json  @DataDog/system-tests-core
manifests/java.yml                                                      @DataDog/asm-java @DataDog/apm-java
manifests/nodejs.yml                                                    @DataDog/dd-trace-js
manifests/python.yml                                                    @DataDog/apm-python @DataDog/asm-python
utils/_context/_scenarios/integration_frameworks.py                     @DataDog/system-tests-core
utils/docker_fixtures/_test_agent.py                                    @DataDog/system-tests-core
utils/docker_fixtures/_test_clients/_test_client_framework_integrations.py  @DataDog/system-tests-core

datadog-datadog-prod-us1 · 2026-07-03T12:37:32Z

Tests

🎉 All green!

❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: bc915c9 | Docs | Datadog PR Page | Give us feedback!}

…APPSEC-68977) Exercise the auto-instrumented AI Guard/OpenAI integration (ai_guard_listen) the way the LLM Obs suite does: call the OpenAI SDK directly through the existing /chat/completions weblog endpoint with DD_AI_GUARD_ENABLED=true, and assert an ai_guard span is emitted for before-model, after-model (streamed) and tool-call evaluation. The evaluation outcome (ALLOW/DENY/ABORT) stays covered by the dedicated AI_GUARD scenario and is not re-asserted here. The AI Guard endpoint is not yet wired into the INTEGRATION_FRAMEWORKS scenario (no DD_AI_GUARD_ENDPOINT / no aiguard VCR cassettes), so the integration path 500s for every language. Marked missing_feature for python, nodejs and java until the scenario wiring + cassettes land. Investigation task: APPSEC-68977 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

library_env now injects real DD_API_KEY/DD_APP_KEY in --generate-cassettes mode (the AI Guard client calls the real API to record the aiguard cassette) and keeps mock keys on replay, where the VCR proxy matches on the request rather than auth. Investigation task: APPSEC-68977 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…-guard-poc

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d95adff1f0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

…-guard-poc

cbeauchesne

Framwork usage : all good

But I let someone familiar with the feature to do the real review.

christophe-papazian

Reviewed the AI Guard PoC. Four inline notes below (findings 1, 2, 4, 6), each with evidence to confirm. Two of these overlap with the resolved Codex-bot threads and, in my reading, are still substantive — flagging so they aren't lost when this moves from draft toward runnable.

…RKS AI Guard test - Keep DD_API_KEY/DD_APP_KEY out of library_env (report metadata) by injecting them via the scenario environment, and fail fast when they are missing during cassette generation instead of a silent xfail. - Assert the tool-call payload (assistant tool_calls) actually reached AI Guard. - Require an assistant message for the after-model eval and skip it until the after-model cassette is regenerated (APPSEC-68977). - Align the module docstring with what is actually asserted (no trace linkage). - Drop the redundant, out-of-scope ai_guard.event assertion from the standalone sampling test. APPSEC-68977 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Streamed after-model evaluation (DD_AI_GUARD_ANALYZE_STREAM_RESPONSES_ENABLED) is not implemented across the other tracer libraries yet, so the after-model test could never replay at cross-language parity and was a false positive (it passed on the before-model prompt span). Remove the test, the stream env var, and the two orphaned streaming cassettes; keep before-model and tool-call coverage. APPSEC-68977 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

avara1986 · 2026-07-17T12:23:11Z

Update — Finding 1 resolved (commit `bc915c9`)

Rather than re-recording the after-model cassette, we removed the streamed after-model test entirely: DD_AI_GUARD_ANALYZE_STREAM_RESPONSES_ENABLED (streamed-response reconstruction) is not implemented across the other tracer libraries yet, so an after-model test can't run at cross-language parity — it could only ever be the false positive that was flagged.

Changes:

Removed test_after_model_validation and the DD_AI_GUARD_ANALYZE_STREAM_RESPONSES_ENABLED env var from library_env.
Deleted the two orphaned streaming cassettes (...after_model_validation_stream_True...5dec5d6a.json, ...5c14b241.json).
Docstring updated to state after-model is intentionally out of scope.
No cassette re-record needed. before-model + tool-call coverage is unchanged.

Updated status table:

Finding	Status
F4 / Codex P1 — DD keys leak via `library_env` + silent xfail	✅ Fixed
Codex P2 / F2 (tool half) — tool-call payload not verified	✅ Fixed
F2 (docstring) — trace linkage asserted nowhere	✅ Fixed
F6 — redundant `ai_guard.event` assert	✅ Fixed
F1 / Codex P2 (after-model) — false positive	✅ Fixed — after-model streaming test removed (not implemented cross-language yet); no re-record needed

avara1986 force-pushed the avara/appsec-68977-integration-frameworks-ai-guard-poc branch from 78379f1 to ca1a97f Compare July 3, 2026 13:02

avara1986 changed the title ~~PoC: AI Guard test under INTEGRATION_FRAMEWORKS (APPSEC-68977)~~ [python] PoC: AI Guard test under INTEGRATION_FRAMEWORKS Jul 3, 2026

avara1986 force-pushed the avara/appsec-68977-integration-frameworks-ai-guard-poc branch from ca1a97f to 4de1a84 Compare July 3, 2026 13:15

avara1986 and others added 3 commits July 3, 2026 16:00

Record openai + aiguard cassettes for TestOpenAiAiGuard (APPSEC-68977)

e19802e

Merge branch 'main' into avara/appsec-68977-integration-frameworks-ai…

61966c4

…-guard-poc

avara1986 commented Jul 13, 2026

View reviewed changes

Comment thread tests/integration_frameworks/llm/openai/test_openai_ai_guard.py Outdated

avara1986 added 4 commits July 13, 2026 11:21

Apply suggestion from @avara1986

824409e

fix codestyle

8ddfd08

fix test

155c452

fix test

d95adff

avara1986 marked this pull request as ready for review July 15, 2026 14:42

avara1986 requested review from a team as code owners July 15, 2026 14:42

avara1986 requested review from brettlangdon, claponcet, manuel-alvarez-alvarez and wconti27 and removed request for a team July 15, 2026 14:42

chatgpt-codex-connector Bot reviewed Jul 15, 2026

View reviewed changes

Comment thread tests/integration_frameworks/llm/openai/test_openai_ai_guard.py Outdated

Comment thread tests/integration_frameworks/llm/openai/test_openai_ai_guard.py

Comment thread tests/integration_frameworks/llm/openai/test_openai_ai_guard.py Outdated

avara1986 added 2 commits July 16, 2026 16:13

Merge branch 'main' into avara/appsec-68977-integration-frameworks-ai…

d33bff7

…-guard-poc

update tests

0656125

avara1986 requested a review from a team as a code owner July 16, 2026 18:43

cbeauchesne reviewed Jul 17, 2026

View reviewed changes

christophe-papazian reviewed Jul 17, 2026

View reviewed changes

gh-worker-ownership-write-b05516 Bot removed the request for review from a team July 17, 2026 11:57

avara1986 and others added 2 commits July 17, 2026 14:09

style: apply ruff format to test_openai_ai_guard.py

3e817df

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[python] PoC: AI Guard test under INTEGRATION_FRAMEWORKS#7257

[python] PoC: AI Guard test under INTEGRATION_FRAMEWORKS#7257
avara1986 wants to merge 13 commits into
mainfrom
avara/appsec-68977-integration-frameworks-ai-guard-poc

avara1986 commented Jul 3, 2026

Uh oh!

github-actions Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

datadog-datadog-prod-us1 Bot commented Jul 3, 2026 •

edited by datadog-prod-us1-5 Bot

Loading

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cbeauchesne left a comment

Uh oh!

christophe-papazian left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

avara1986 commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

avara1986 commented Jul 3, 2026

What

Status: DRAFT / investigation

Jira

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

datadog-datadog-prod-us1 Bot commented Jul 3, 2026 • edited by datadog-prod-us1-5 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cbeauchesne left a comment

Choose a reason for hiding this comment

Uh oh!

christophe-papazian left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

avara1986 commented Jul 17, 2026

Update — Finding 1 resolved (commit bc915c9)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Jul 3, 2026 •

edited

Loading

datadog-datadog-prod-us1 Bot commented Jul 3, 2026 •

edited by datadog-prod-us1-5 Bot

Loading

Update — Finding 1 resolved (commit `bc915c9`)