feat(guardrails): resolve BYOG by validator name only [AL-510] - #1840
Merged
Conversation
The Agents backend now enforces BYOG validator-name uniqueness per tenant and no longer accepts a connection id at validation nor persists one in the agent (UiPath/Agents#5959): the name alone resolves the configuration and the Integration Service connection is taken from it server-side, so an admin rebind is always honored. Remove the connection id from the coded-agents surface accordingly: - BuiltInValidatorGuardrail: drop the byo_connection_id field. Legacy json carrying byoConnectionId still parses (extra="allow") but the value is inert - covered by a compat test asserting it is never forwarded. - GuardrailsService.evaluate_guardrail: stop forwarding byoConnectionId; the byo payload carries byoValidatorName only. - ByoValidator: remove the connection_id kwarg; docstring now states names are unique per tenant and drops the (real, tenant-specific) connection id that was still embedded in the example. - Tests updated: name-only construction/serialization/forwarding, plus the legacy-field compat pins. - Bump uipath-platform to 0.2.17, both lockfiles synced. Breaking only in the narrow sense that ByoValidator(connection_id=...) from 0.2.14-0.2.16 now raises TypeError; the parameter shipped days ago and the server already ignores the field it fed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
github-actions
Bot
added
test:uipath-langchain
Contributor
There was a problem hiding this comment.
Pull request overview
This PR aligns the Python SDK’s BYOG (Bring Your Own Guardrail) support with the Agents backend change that resolves BYOG configuration by validator name only (per tenant), removing the now-dead Integration Service connection-id from the SDK surface and ensuring it is never sent over the wire.
Changes:
- Removed
byo_connection_idfromBuiltInValidatorGuardrailand stopped forwardingbyoConnectionIdinGuardrailsService.evaluate_guardrail. - Updated
ByoValidatorto be name-only (removedconnection_idkwarg) and refreshed docstring/example accordingly. - Updated/added tests to pin legacy JSON parsing behavior while asserting
byoConnectionIdis never forwarded; bumpeduipath-platformto0.2.17and synced lockfiles.
Reviewed changes
Copilot reviewed 6 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| packages/uipath/uv.lock | Updates locked editable uipath-platform version to 0.2.17. |
| packages/uipath-platform/uv.lock | Updates locked package version to 0.2.17. |
| packages/uipath-platform/tests/services/test_guardrails_service.py | Verifies BYOG payload includes only byoValidatorName and never forwards legacy byoConnectionId; pins legacy parse behavior. |
| packages/uipath-platform/tests/services/test_guardrails_decorators.py | Updates decorator-layer tests for name-only ByoValidator and asserts byoConnectionId is absent from dumps. |
| packages/uipath-platform/src/uipath/platform/guardrails/guardrails.py | Removes typed byo_connection_id field while retaining legacy-json tolerance via extra="allow". |
| packages/uipath-platform/src/uipath/platform/guardrails/decorators/validators/byo.py | Removes connection_id kwarg and updates docs/example to validator-name-only semantics. |
| packages/uipath-platform/src/uipath/platform/guardrails/_guardrails_service.py | Stops adding byoConnectionId to the evaluation request payload. |
| packages/uipath-platform/pyproject.toml | Bumps uipath-platform version to 0.2.17. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Merged
4 tasks
valentinabojan
approved these changes
Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed?
The Agents backend now enforces BYOG validator-name uniqueness per tenant and no longer accepts a connection id at validation nor persists one in the agent (UiPath/Agents#5959, AL-510): the name alone resolves the configuration, and the Integration Service connection is taken from it server-side — an admin rebind is always honored. This PR removes the now-dead connection id from the coded-agents surface.
BuiltInValidatorGuardrail— thebyo_connection_idfield is removed. Legacy json carryingbyoConnectionIdstill parses (extra="allow") but the value is inert; a compat test pins that it is never forwarded to the service.GuardrailsService.evaluate_guardrail— stops forwardingbyoConnectionId; thebyopayload carriesbyoValidatorNameonly.ByoValidator— theconnection_idkwarg is removed; the docstring now states names are unique per tenant, and the example loses the (real, tenant-specific) connection id it still embedded.uipath-platform0.2.17, both lockfiles synced.Version-skew safety: published
uipath-langchainreleases (0.14.18–0.14.20) still passbyo_connection_id=when constructing the model — withextra="allow"that lands as an inert extra attribute the service never reads, and the server ignores the JSON field anyway. All old/new combinations are safe; no coordinated release needed.How has this been tested?
test_guardrails_service.py: the BYOG payload containsbyoValidatorNameand nobyoConnectionId— including when a legacybyoConnectionIdis present on the parsed model, and for non-byo validator types; legacy-json parse compat pinned.test_guardrails_decorators.py:ByoValidatorname-only construction, wire serialization (assertsbyoConnectionIdabsent from the dump), parameter passthrough, run-forwarding.uipath-platformpackage suite green;ruff check,ruff format --check,mypy src testsclean;uv lock --checkclean in both affected packages.Are there any breaking changes?
ByoValidator(connection_id=...)from 0.2.14–0.2.16 now raisesTypeError, andBuiltInValidatorGuardrail.byo_connection_idis no longer a typed field. Both shipped days ago (July 29), and the server already ignores the field they fed — deliberate hard removal in agreement with the backend change rather than a deprecation shim.🤖 Generated with Claude Code