semantic-kernel-tool-policy

semantic-kernel-tool-policy

Requirement	Version
Agent Assembly Python SDK (agent-assembly)	>= 0.0.1rc6

Install:

uv add agent-assembly==0.0.1rc6
# or
pip install agent-assembly==0.0.1rc6

Demonstrates Agent Assembly governance of a Microsoft Semantic Kernel agent's tool calls.

Not the Microsoft Agent Framework. Semantic Kernel and the Microsoft Agent Framework are two different Microsoft projects. The Agent Framework has its own example (microsoft-agent-framework-tool-policy) and a native Agent Assembly adapter. This example targets Semantic Kernel, which has no native adapter.

Because Semantic Kernel has no native adapter, this example governs it the framework-agnostic way — the same path the custom-tool-policy example uses. Every real KernelFunction invocation is routed through Agent Assembly's callback host (AssemblyCallbackHandler), which consults a local policy before Kernel.invoke reaches the function body: a deny short-circuits the function entirely (its body never runs), an allow runs it. The demo drives genuine Semantic Kernel native functions — the same KernelFunction objects a Kernel invokes — so you can watch the safe tools run and the dangerous one get blocked, with no gateway, API key, or live LLM.

What this example demonstrates

• Initializing Agent Assembly with init_assembly().
• Governing real Semantic Kernel KernelFunction calls at their execution chokepoint (Kernel.invoke).
• An allowed tool call (get_weather) that runs and returns its real output.
• Another allowed tool call (summarize_docs).
• A denied tool call (execute_sql) whose body is short-circuited by deny_arbitrary_execution — the function never executes.

Prerequisites

Requirement	Version
Python	>= 3.12
uv	latest
Agent Assembly Python SDK	>= 0.0.1rc6
semantic-kernel	>= 1.39.4

No API key or running gateway is required for the offline demo — the tools are native (code) KernelFunctions, so no LLM connector is configured.

Setup

cd python/semantic-kernel-tool-policy
uv sync --extra dev

Run

uv run python src/main.py

Expected output

==============================================================
  Agent Assembly — Semantic Kernel Tool Policy Demo
==============================================================

Initializing Agent Assembly (gateway: http://localhost:8080, sdk-only mode)...
  Agent:    semantic-kernel-demo-agent
  Gateway:  http://localhost:8080
  Mode:     sdk-only (offline demo)

Policy rules (local simulation of gateway policy):
  DENY   — execute_sql, run_shell_command  (arbitrary execution)
  ALLOW  — everything else

Governing real Semantic Kernel KernelFunction.invoke calls.
Tools governed: get_weather, summarize_docs, execute_sql

Running governed tool calls:
--------------------------------------------
  → get_weather({'city': 'London'})
     ✅ ALLOWED  — Weather in London: sunny, 22C (mock)

  → summarize_docs({'topic': 'policy enforcement'})
     ✅ ALLOWED  — Summary for 'policy enforcement': Agent Assembly provides governance... (mock)

  → execute_sql({'sql': 'DROP TABLE users; --'})
     ❌ BLOCKED  — Tool 'execute_sql' is blocked by policy rule 'deny_arbitrary_execution'.

Assembly context shut down.

Run tests

uv run pytest tests/ -v

The smoke tests are a real governance proof: the deny test asserts the denied function's body never ran (a no-op governance path would let it execute), and the allow test asserts the real function body ran and returned its output.

How governance attaches

Semantic Kernel has no native adapter, so this example wires governance explicitly: it wraps each real Kernel.invoke call with a policy check (AssemblyCallbackHandler → check_tool_start) that raises ToolExecutionBlockedError on a deny. In production the same check_tool_start contract is answered by the live runtime instead of the offline LocalPolicyEngine.

Switching to production mode

1. Start an Agent Assembly gateway or use your SaaS workspace URL.
2. Copy .env.example to .env and fill in credentials.
3. Point init_assembly() at the gateway and let the live runtime answer each check_tool_start:

with init_assembly(gateway_url="http://localhost:8080", agent_id="my-sk-agent") as ctx:
    # Route your Kernel.invoke calls through governed_invoke(); the live runtime
    # governs each one instead of the demo policy.
    ...

Troubleshooting

Problem	Fix
ModuleNotFoundError: agent_assembly	Run uv sync first
ModuleNotFoundError: semantic_kernel	Run uv sync — semantic-kernel is a required dependency
execute_sql shows ALLOWED	The policy engine was not wired into governed_invoke — pass a LocalPolicyEngine() instance

Links

• Agent Assembly Python SDK
• Semantic Kernel docs
• Agent Assembly Examples
• Python Examples