[Hosted agents 10] Prove document-level authorization through the hosted path

[placerda]

Summary

Prove end-to-end document-level authorization for hosted orchestration with two users from different Entra groups.

Why will we implement this?

• Problem / opportunity: The hosted gateway changes identity propagation and can accidentally bypass classic OBO trimming.
• Business value / outcome: Hosted mode preserves GPT-RAG's non-negotiable security boundary.
• Success metrics (how we know it worked): The authorized user retrieves a protected document and the unauthorized user cannot retrieve or infer it through chat, citations, tools, or logs.

What does it do? (Functional Overview)

• Core behavior: Validate the task-01 identity contract through UI, hosted agent, Toolbox, Foundry IQ/Search, and document permissions; include negative tests.
• Data collection / storage needs: Use synthetic test identities/documents and never record bearer tokens.
• Data analysis / reporting needs: Capture authorization decisions and correlation evidence without protected content.
• Nice to have (stretch goals): Automated regression fixture for both classic and hosted paths.

Components

• Components (check all that apply):
  • gpt-rag-orchestrator
  • gpt-rag-ingestion
  • gpt-rag-ui
  • gpt-rag-mcp

Dependencies and acceptance criteria

• Depends on: [Hosted agents 09] Validate the three deployment modes end to end #592.
• Both positive and negative users are exercised.
• No token appears in hosted-agent or tool logs.
• Failure blocks hosted-mode promotion; there is no silent security fallback.

[placerda]

Hosted authorization gate — fail-closed source verdict at exact pins

The required two-user live proof cannot pass at the released UI v2.5.0 / orchestrator v3.9.0 / ingestion v2.6.0 pins. This is an implementation-contract blocker, not missing structural evidence.

Verified request chain

• UI hosted client acquires a token with the UI managed identity for HOSTED_AGENT_RESOURCE_SCOPE; it does not use the signed-in user's delegated identity.
• Hosted invocation payload contains messages, conversation ID, question ID, and correlation ID only.
• Hosted entrypoint sets TurnRequest.user_context={} and explicitly does not trust caller/model identity fields.
• The protocol-2 opaque x-agent-foundry-call-id is not captured or forwarded to Toolbox.
• Internal retrieval therefore uses service identity/default anonymous security context rather than Foundry Toolbox OAuth identity passthrough.
• Ingestion's hosted /retrieve endpoint is correctly fail-closed behind HOSTED_RETRIEVAL_ENABLED and HOSTED_RETRIEVAL_INV_002_VALIDATED; enabling it cannot repair the missing upstream caller contract.

The native target documented by Microsoft requires the signed-in user to call the hosted agent and the container to echo only the opaque Foundry call ID to Toolbox. No bearer token or group list should enter the container or logs.

Remediation in progress

Coordinated feature branches are implementing:

1. UI server-side OBO to the hosted data-plane scope with no managed-identity fallback when user authorization is required.
2. Orchestrator capture/validation of the platform call context and opaque call-ID propagation to Toolbox, fail-closed when absent.
3. Focused tests for missing/wrong identity, concurrent-user isolation, no token logging, and unchanged classic behavior.

No tags, releases, or umbrella pin changes are authorized. New component pins will require a repeat of the two-user/two-group positive and negative tests through chat, citations, tools, direct retrieval, and telemetry.

Disposition

Leave #591 open. Do not enable group-filter fallback or claim native authorization until the component PRs merge, new releases are explicitly approved, and the full live gate is repeated.

[placerda]

Remediation PRs and required revalidation order

The fail-closed implementation work is now in reviewed feature PRs targeting component develop branches:

• UI OBO caller identity: fix: use on-behalf-of delegated identity for hosted-agent calls (#591) gpt-rag-ui#87 — 192 tests, CI green, final independent review clean.
• Hosted call-context → Toolbox propagation: feat: propagate Foundry Toolbox identity passthrough for hosted mcp retrieval gpt-rag-orchestrator#287 — 650 tests, CI green, final independent review clean.

No release/tag or umbrella pin update was performed.

Required release/integration order

1. Merge the UI and orchestrator PRs to their develop branches after maintainer review.
2. With explicit human publication approval, release new immutable UI and orchestrator versions. Ingestion v2.6.0 already contains the fail-closed delegated-token /retrieve contract.
3. Update the umbrella manifest only after those releases exist. Hosted authorization validation must select AGENT_STRATEGY=mcp, default HOSTED_AGENT_AUTH_MODE=user_delegated, and an identity-aware Toolbox endpoint; service_identity is not acceptable evidence for this gate.
4. Configure delegated hosted scope consent, Foundry Agent Consumer RBAC for both users, Toolbox OAuth identity passthrough, and the ingestion INV-002 gates.
5. Repeat the full isolated two-user/two-group proof through chat, citations, Toolbox/retrieval, direct citation access, and metadata-only telemetry. Missing/malformed caller context and downstream auth failure must remain explicit with no fallback; scan logs for bearer/protected-content absence.

#591 remains open until that live sequence passes on new released pins.