Uh oh!
There was an error while loading. Please reload this page.
Samples: add ATR security guardrail plugin - #6130
Closed
eeee2345 wants to merge 1 commit into
Closed
Conversation
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
eeee2345
commented
Jun 16, 2026
Author
@googlebot I signed it! |
Adds contributing/samples/plugin/plugin_atr_guardrail/, a sample Plugin that enforces an AI-agent security policy globally across a Runner using the open, MIT-licensed Agent Threat Rules (ATR) engine (pip install pyatr). It demonstrates three fail-closed enforcement points: - before_run_callback halts the run on a malicious user message (before any model call, so no model credentials are needed to see the block) - before_model_callback skips the model call if the assembled prompt still carries a threat (defense in depth) - before_tool_callback returns an error dict instead of executing a tool whose arguments match a rule Sample-only: no package dependency or public API change; pyatr is imported inside the sample and the rule count is read at runtime rather than hard-coded. Motivated by maintainer interest in tool-call / prompt-injection defense (cf. google#5913, google#6099). Signed-off-by: Adam Lin <adam@agentthreatrule.org>
eeee2345force-pushed
the
samples/atr-guardrail-plugin
branch
from
June 16, 2026 03:45
e53367c to
0ae7718Comparerohityan
commented
Jun 17, 2026
Collaborator
Hi @eeee2345, Thank you for your contribution! We appreciate you taking the time to submit this pull request. |
This was referenced Jun 18, 2026
koverholt added a commit
to google/adk-docs
that referenced
this pull request
Jun 24, 2026
) * docs(integrations): add Agent Threat Rules (ATR) guardrail plugin Adds docs/integrations/atr-guardrail.md (+ icon) for the adk-atr-guardrail package -- an in-process, deterministic security guardrail that enforces the open-source Agent Threat Rules ruleset at three fail-closed Runner callbacks (before_run / before_model / before_tool). Tagged 'resilience'. Created per maintainer guidance on google/adk-python#6130 to ship as a standalone package listed in the integrations catalog. Verified locally with mkdocs build. * Use gemini-flash-latest, switch to the App plugin pattern with ADK >= 2.0, and remove the resilience catalog tag --------- Co-authored-by: Kristopher Overholt <koverholt@google.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This adds a sample plugin, contributing/samples/plugin/plugin_atr_guardrail/, that enforces an agent security policy globally across a Runner using the open-source Agent Threat Rules engine (pip install pyatr).
It demonstrates three fail-closed enforcement points, each returning a value that short-circuits the lifecycle:
It is sample-only: no package dependency or public API change; pyatr is imported inside the sample, and the rule count is read at runtime rather than hard-coded.
Testing plan
Local checks: pyink, isort (profile google), and mdformat-gfm all clean on the new files; Apache license headers present; no logging.getLogger(name) pattern. Motivated by maintainer interest in tool-call / prompt-injection defense (#5913, #6099).
Disclosure: I maintain the ATR project referenced here. This is a sample only and is not registered in the public plugins package.