.NET/Python: Add more content types to purview handling

[westey (westey-m)]

Motivation & Context

Description & Review Guide

• Add more content types to purview handling
• Improve blocking behavior

Related Issue

Fixes #

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

Blocking semantics and content serialization currently introduce incorrect enforcement and potential policy-evaluation gaps.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Expands Purview policy evaluation across Python and .NET while strengthening fail-closed behavior.

Changes:

• Evaluates binary, reasoning, and structured content.
• Improves identity, scope, and blocking behavior.
• Adds cross-language tests and security guidance.

File summaries

File	Description
python/packages/purview/tests/purview/test_processor.py	Tests expanded processing and fail-closed behavior.
python/packages/purview/README.md	Documents security and identity handling.
python/packages/purview/agent_framework_purview/_processor.py	Implements expanded content mapping and enforcement.
python/packages/purview/agent_framework_purview/_models.py	Adds restrictAccess support.
dotnet/tests/Microsoft.Agents.AI.Purview.UnitTests/ScopedContentProcessorTests.cs	Tests new .NET behavior.
dotnet/src/Microsoft.Agents.AI.Purview/ScopedContentProcessor.cs	Expands content evaluation and blocking logic.
dotnet/src/Microsoft.Agents.AI.Purview/README.md	Adds security guidance.

Review details

Suppressed comments (5)

python/packages/purview/agent_framework_purview/_processor.py:137

• restrictAccess is not inherently a block: it can carry nonblocking restriction modes such as audit, warn, or allow. This condition therefore rejects content for audit-only policies; only blockAccess or an explicit restrictionAction=block should set the blocking flag.

    return (
        action_info.action in (DlpAction.BLOCK_ACCESS, DlpAction.RESTRICT_ACCESS)
        or action_info.restriction_action == RestrictionAction.BLOCK
    )

python/packages/purview/agent_framework_purview/_processor.py:77

• default=str silently turns arbitrary function-result values into representations such as <Foo object at ...>, discarding their fields while allowing the request to pass policy evaluation. Since Content.result accepts arbitrary objects and to_dict() can leave them intact, serialization must preserve their data or fail closed instead of stringifying them.

        return json.dumps(value, default=str, sort_keys=True)
    except (TypeError, ValueError):
        return str(value)

dotnet/src/Microsoft.Agents.AI.Purview/README.md:291

• This repeats the wrong .NET property key: the integration reads "userId", so the security warning should name that exact key to avoid misleading hosts about which caller-controlled field must be protected.

model response can influence `AdditionalProperties["user_id"]` or `AuthorName`, that party can select a

python/packages/purview/agent_framework_purview/_processor.py:106

• A reasoning item can contain protected_data with text=None (signature-only reasoning is supported), but this branch submits an empty string and drops that payload. Serialize the complete reasoning item so it is not released after Purview evaluated only empty content.

    if content_type in ("text", "text_reasoning"):
        return PurviewTextContent(data=content.text or "")

dotnet/src/Microsoft.Agents.AI.Purview/ScopedContentProcessor.cs:257

• TextReasoningContent may carry ProtectedData even when Text is null, but this branch sends only an empty string to Purview and drops the remaining payload. Serialize the whole reasoning content so signature-only/protected reasoning is not treated as evaluated empty content.

            case TextReasoningContent reasoningContent:
                return new PurviewTextContent(reasoningContent.Text ?? string.Empty);

• Files reviewed: 7/7 changed files
• Comments generated: 4
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 55cb51a04360
Model: gpt-5.6-sol-fast

Overview

The PR substantially broadens Purview evaluation to cover non-text content, adds fail-closed handling, and backs the new mapping and offline behavior with focused tests. The runtime-type serialization and unknown-execution-mode guards are particularly strong. However, the new blocking helper in both implementations treats every parameterized restrictAccess action as a hard block, so audit, warn, and allow policies can now stop otherwise permitted prompts and responses.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 high) across 2 files. Details are attached to the affected lines below.

Affected areas: dotnet/src/Microsoft.Agents.AI.Purview/ScopedContentProcessor.cs, python/packages/purview/agent_framework_purview/_processor.py