feat: add guarded durable-memory ADK recipe - #2507
vgudur-dev wants to merge 4 commits into
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
| [project] | ||
| name = "amg-memory-guard" | ||
| version = "0.1.0" | ||
| description = "Guard Google ADK durable session-state writes with OWASP Agent Memory Guard." |
There was a problem hiding this comment.
This doesn't match description in manifest.yaml ("A Google ADK recipe that screens external observations before they are committed to durable session state."), and check_recipe_pyproject.py fails the PR when the two disagree. I suggest matching this one to the manifest.
| "rule": exc.rule, | ||
| } | ||
|
|
||
| tool_context.state["guarded_external_observation"] = content |
There was a problem hiding this comment.
It seems the state write happens whatever action comes back as, since only a raised PolicyViolation skips it. Is allow the only outcome that doesn't raise?
| if tool_context is None: | ||
| return {"status": "error", "message": "ADK tool context is required."} | ||
|
|
||
| session_id = tool_context._invocation_context.session.id |
There was a problem hiding this comment.
_invocation_context isn't guarded like tool_context just above
| @@ -0,0 +1 @@ | |||
| MODEL_NAME=gemini-3.5-flash | |||
There was a problem hiding this comment.
MODEL_NAME is the only key here — should GOOGLE_GENAI_USE_VERTEXAI and the credentials vars go in too? contrib/python/market-research-agent/.env.example has them, and the README sends the reader through cp .env.example .env before adk run.
| @@ -0,0 +1,18 @@ | |||
| """Google ADK durable-memory protection recipe.""" | |||
There was a problem hiding this comment.
licence header sits under the docstring in this one
happyhuman
left a comment
happyhuman
left a comment
There was a problem hiding this comment.
Please go through the comments, and also the failed workflows and fix them.
2 participants
Summary
This contribution adds a standalone community recipe that places OWASP Agent Memory Guard (AMG) at the durable-session-state boundary of a Google ADK agent. It retains a benign external observation while blocking a representative indirect prompt-injection payload before it reaches session state.
The recipe follows the repository’s standalone Python layout and includes a manifest,
pyproject.toml, environment example, runnable agent module, README, and isolated tests.Demonstrated control boundary
Tool-derived observations are marked as
EXTERNAL_TOOL, every proposed durable write passes throughMemoryGuard(policy=Policy.strict()), and ADK state is updated only after AMG permits the operation. A blocked write returns structured security information for the application’s logging or incident workflow.Validation
The recipe passed the repository’s recipe validation, manifest schema, placement checks, README checks, Ruff format/lint checks, and two isolated no-network tests. It uses no model API key and makes no production-security guarantee; it is a focused implementation pattern for an ADK durable-memory boundary.