agentops-accelerator 0.3.23__tar.gz → 0.4.2__tar.gz

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.2}/.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "agentops-accelerator",
       "source": "../../plugins/agentops",
       "description": "Copilot agent skills for running standardized evaluation workflows with AgentOps Toolkit and Microsoft Foundry agents.",
-      "version": "0.3.23",
+      "version": "0.4.1",
       "keywords": [
         "agentops",
         "evaluation",

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.2}/.github/plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "agentops-accelerator",
       "source": "../../plugins/agentops",
       "description": "Copilot agent skills for running standardized evaluation workflows with AgentOps Toolkit and Microsoft Foundry agents.",
-      "version": "0.3.23",
+      "version": "0.4.1",
       "keywords": [
         "agentops",
         "evaluation",

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.2}/AGENTS.md

@@ -472,7 +472,7 @@ Authentication rule (Windows-friendly):
 
 Recommended default behavior:
 - Keep Foundry cloud mode as the default for `name:version` agents
-- Install Azure runtime dependencies via the `[foundry]` extra
+- Install AgentOps normally; Foundry runtime dependencies are part of the default package
 - Keep Azure SDK imports inside functions (lazy) in `pipeline/` and `agent/`
 - Do not hardcode `api_version` in `get_openai_client()` — the SDK picks it
 

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.2}/CHANGELOG.md

@@ -5,6 +5,75 @@ This format follows [Keep a Changelog](https://keepachangelog.com/) and adheres
 
 ## [Unreleased]
 
+## [0.4.2] - 2026-06-17
+
+### Fixed
+- **`agentops eval init` now works with both old and new `azure.ai.agents` azd
+  extensions.** Version 0.1.40 of the extension renamed the eval subcommand from
+  `azd ai agent eval init` to `azd ai agent eval generate`, which made
+  `agentops eval init` hard-fail with `Command "init" is deprecated, use 'azd ai
+  agent eval generate' instead`. AgentOps now invokes `generate` first and
+  transparently falls back to the legacy `init` subcommand when an older
+  extension does not recognise `generate`. The fallback only triggers on
+  subcommand-name/deprecation errors; genuine failures (authentication, project
+  endpoint, timeouts) are still surfaced immediately and unchanged. All
+  previously passed flags (`--project-endpoint`, `--agent`,
+  `--gen-instruction-file`, `--eval-model`, `--dataset`, `--evaluator`) and the
+  recipe discovery/persistence behaviour are preserved.
+
+## [0.4.1] - 2026-06-15
+
+### Changed
+- **PR-stage Foundry prompt-agent versions are now tagged at the source.** When
+  `agentops.pipeline.prompt_deploy stage` runs in a PR context (GitHub Actions
+  `pull_request` event or Azure DevOps `BUILD_REASON=PullRequest`), the version
+  it creates in the dev Foundry project carries metadata
+  `agentops:candidate=true`, `agentops:pr=<number>`, and
+  `agentops:created_at=<ISO timestamp>`. Portal viewers can filter the
+  Versions tab on `agentops:candidate` to separate abandoned PR candidates
+  from deployed-of-record versions, and downstream consumers that resolve
+  "latest" can refuse to pick up candidates. Deployed-of-record versions
+  (push to `main`/`develop`/`release/**` or `workflow_dispatch`) are not
+  tagged, so absence of `agentops:candidate` is the deployed-of-record
+  signal. The PR/deploy workflow templates and the prompt-agent quickstart
+  tutorial are updated to describe the new contract.
+  ([#214](https://github.com/Azure/agentops/issues/214))
+
+## [0.4.0] - 2026-06-14
+
+### Added
+- **`agentops doctor` now detects missing OpenAI data-plane RBAC on the Foundry
+  resource.** A new `security.missing_openai_data_plane_rbac` check resolves the
+  signed-in principal (via the `oid` claim of the access token used by
+  `DefaultAzureCredential`) and lists role assignments at the Foundry account
+  scope using `azure-mgmt-authorization`. When none of *Cognitive Services
+  OpenAI User*, *Cognitive Services OpenAI Contributor* or *Cognitive Services
+  Contributor* is present (directly or inherited), Doctor surfaces an
+  actionable WARNING that includes the exact `az role assignment create`
+  command for *Cognitive Services OpenAI User* scoped to the Foundry account.
+  The check is read-only and skips silently when the SDK, principal or scope
+  cannot be resolved. ([#228](https://github.com/Azure/agentops/issues/228))
+
+### Changed
+- **`agentops-pr` workflow templates now auto-detect a committed baseline.**
+  Both the GitHub Actions (`.github/workflows/agentops-pr.yml`) and Azure
+  DevOps (`.azuredevops/pipelines/agentops-pr.yml`) PR templates emitted by
+  `agentops workflow generate` wrap `agentops eval run` with a small bash
+  guard. When `.agentops/baseline/results.json` exists in the consumer
+  repo, the step automatically passes `--baseline .agentops/baseline/results.json`;
+  without the file the behaviour is unchanged. Aligns shipped templates
+  with the `tutorial-baseline-comparison.md` "drop a file in your repo"
+  promise. Deploy templates (`dev`/`qa`/`prod`) are untouched.
+  ([#155](https://github.com/Azure/agentops/issues/155))
+
+### Fixed
+- **`agentops skills install --platform` help text now lists `cursor`.** The
+  CLI option help was advertising only `copilot` and `claude` even though the
+  `cursor` platform is fully implemented (registers rules in
+  `.cursor/rules/agentops.mdc`). Updated to `Target platform(s): copilot,
+  claude, cursor.` so users discover the supported value from `--help`.
+  ([#157](https://github.com/Azure/agentops/issues/157))
+
 ## [0.3.23] - 2026-06-12
 
 ### Fixed

agentops_accelerator-0.4.2/PKG-INFO

@@ -0,0 +1,114 @@
+Metadata-Version: 2.4
+Name: agentops-accelerator
+Version: 0.4.2
+Summary: Release readiness gates and evidence for Microsoft Foundry agents
+License: MIT License
+        
+        Copyright (c) Microsoft Corporation.
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+        
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: typer<1.0,>=0.12
+Requires-Dist: pydantic<3,>=2
+Requires-Dist: ruamel.yaml<1.0,>=0.18
+Requires-Dist: azure-ai-projects<3.0,>=2.0.1
+Requires-Dist: azure-ai-evaluation<2.0,>=1.0
+Requires-Dist: azure-identity<2.0,>=1.17
+Requires-Dist: azure-monitor-opentelemetry<2.0,>=1.6
+Requires-Dist: pandas<4.0,>=2.0
+Provides-Extra: mcp
+Requires-Dist: mcp<2,>=1.0; extra == "mcp"
+Provides-Extra: agent
+Requires-Dist: fastapi<1.0,>=0.110; extra == "agent"
+Requires-Dist: uvicorn[standard]<1.0,>=0.30; extra == "agent"
+Requires-Dist: httpx<1.0,>=0.27; extra == "agent"
+Requires-Dist: cryptography>=42; extra == "agent"
+Requires-Dist: markdown<4.0,>=3.6; extra == "agent"
+Requires-Dist: azure-monitor-query<3.0,>=1.3; extra == "agent"
+Requires-Dist: azure-monitor-opentelemetry<2.0,>=1.6; extra == "agent"
+Requires-Dist: azure-identity<2.0,>=1.17; extra == "agent"
+Requires-Dist: azure-mgmt-cognitiveservices<15.0,>=13.5; extra == "agent"
+Requires-Dist: azure-mgmt-monitor<7.0,>=6.0; extra == "agent"
+Requires-Dist: azure-mgmt-authorization<5.0,>=4.0; extra == "agent"
+Dynamic: license-file
+
+<h1 align="center">AgentOps Accelerator</h1>
+
+<p align="center">
+<b>Evaluate. Ship. Observe. Own.</b>
+<br/>
+Continuous evaluation, safety testing, observability, and release readiness for Microsoft Foundry agents.
+</p>
+
+<p align="center">
+<a href="https://aka.ms/agentops-accelerator"><b>Documentation</b></a> |
+<a href="https://pypi.org/project/agentops-accelerator/">PyPI</a> |
+<a href="https://marketplace.visualstudio.com/items?itemName=AgentOpsAccelerator.agentops-accelerator">VS Code Extension</a> |
+<a href="https://github.com/Azure/agentops/releases/latest">Latest release</a>
+</p>
+
+<p align="center">
+<a href="https://pypi.org/project/agentops-accelerator/"><img alt="PyPI" src="https://img.shields.io/pypi/v/agentops-accelerator.svg?label=PyPI&color=blue"/></a>
+<a href="https://marketplace.visualstudio.com/items?itemName=AgentOpsAccelerator.agentops-accelerator"><img alt="VS Code Extension" src="https://img.shields.io/badge/VS%20Code-Extension-007ACC.svg?logo=visualstudiocode"/></a>
+<a href="https://github.com/Azure/agentops/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/Azure/agentops/actions/workflows/ci.yml/badge.svg?branch=develop"/></a>
+<a href="https://github.com/Azure/agentops/actions/workflows/release.yml"><img alt="Release" src="https://github.com/Azure/agentops/actions/workflows/release.yml/badge.svg"/></a>
+<a href="https://github.com/Azure/agentops/blob/main/LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-green.svg"/></a>
+</p>
+
+AgentOps Accelerator helps Microsoft Foundry agent teams evaluate quality, prepare releases, monitor behavior, and stay accountable after launch. It gives you a practical starting point for agent operations, with Foundry integration as the default path and deeper setup guidance in the full docs.
+
+## Get started
+
+```powershell
+python -m pip install agentops-accelerator
+agentops init
+agentops eval analyze
+agentops eval run
+agentops doctor --evidence-pack
+```
+
+## What it helps you do
+
+Use AgentOps Accelerator when you need to:
+
+- Evaluate an agent before release
+- Compare changes across versions
+- Capture release evidence
+- Monitor agent quality and regressions
+- Give teams a repeatable way to own agent behavior in production
+
+The accelerator keeps the local workflow simple, then points you to the full
+docs when you are ready to configure pipelines, dashboards, and release
+practices.
+
+## Learn more
+
+For setup guides, tutorials, architecture, CI/CD guidance, Doctor checks, and
+evaluator reference, see:
+
+<p align="center">
+<a href="https://aka.ms/agentops-accelerator"><b>https://aka.ms/agentops-accelerator</b></a>
+</p>
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development, testing, and contribution guidance.

agentops_accelerator-0.4.2/README.md

@@ -0,0 +1,61 @@
+<h1 align="center">AgentOps Accelerator</h1>
+
+<p align="center">
+<b>Evaluate. Ship. Observe. Own.</b>
+<br/>
+Continuous evaluation, safety testing, observability, and release readiness for Microsoft Foundry agents.
+</p>
+
+<p align="center">
+<a href="https://aka.ms/agentops-accelerator"><b>Documentation</b></a> |
+<a href="https://pypi.org/project/agentops-accelerator/">PyPI</a> |
+<a href="https://marketplace.visualstudio.com/items?itemName=AgentOpsAccelerator.agentops-accelerator">VS Code Extension</a> |
+<a href="https://github.com/Azure/agentops/releases/latest">Latest release</a>
+</p>
+
+<p align="center">
+<a href="https://pypi.org/project/agentops-accelerator/"><img alt="PyPI" src="https://img.shields.io/pypi/v/agentops-accelerator.svg?label=PyPI&color=blue"/></a>
+<a href="https://marketplace.visualstudio.com/items?itemName=AgentOpsAccelerator.agentops-accelerator"><img alt="VS Code Extension" src="https://img.shields.io/badge/VS%20Code-Extension-007ACC.svg?logo=visualstudiocode"/></a>
+<a href="https://github.com/Azure/agentops/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/Azure/agentops/actions/workflows/ci.yml/badge.svg?branch=develop"/></a>
+<a href="https://github.com/Azure/agentops/actions/workflows/release.yml"><img alt="Release" src="https://github.com/Azure/agentops/actions/workflows/release.yml/badge.svg"/></a>
+<a href="https://github.com/Azure/agentops/blob/main/LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-green.svg"/></a>
+</p>
+
+AgentOps Accelerator helps Microsoft Foundry agent teams evaluate quality, prepare releases, monitor behavior, and stay accountable after launch. It gives you a practical starting point for agent operations, with Foundry integration as the default path and deeper setup guidance in the full docs.
+
+## Get started
+
+```powershell
+python -m pip install agentops-accelerator
+agentops init
+agentops eval analyze
+agentops eval run
+agentops doctor --evidence-pack
+```
+
+## What it helps you do
+
+Use AgentOps Accelerator when you need to:
+
+- Evaluate an agent before release
+- Compare changes across versions
+- Capture release evidence
+- Monitor agent quality and regressions
+- Give teams a repeatable way to own agent behavior in production
+
+The accelerator keeps the local workflow simple, then points you to the full
+docs when you are ready to configure pipelines, dashboards, and release
+practices.
+
+## Learn more
+
+For setup guides, tutorials, architecture, CI/CD guidance, Doctor checks, and
+evaluator reference, see:
+
+<p align="center">
+<a href="https://aka.ms/agentops-accelerator"><b>https://aka.ms/agentops-accelerator</b></a>
+</p>
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development, testing, and contribution guidance.

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.2}/docs/tutorial-prompt-agent-quickstart.md

@@ -1370,11 +1370,18 @@ The PR workflow now has two jobs:
 
 > **Why does the PR workflow stage in dev, not sandbox?** The PR gate
 > must evaluate the same target the deploy workflow will use. Sandbox
-> is the author's playground and never receives CI traffic. PR
-> candidates accumulate in dev over time and may need periodic
-> cleanup according to your team's Foundry retention policy; AgentOps
-> uses prompt SHAs and git SHAs as the durable identity, not old
-> candidate version numbers.
+> is the author's playground and never receives CI traffic.
+>
+> Candidate versions created by PR runs are tagged in Foundry with
+> `agentops:candidate=true` plus `agentops:pr=<number>` and
+> `agentops:created_at=<ISO timestamp>`. Portal viewers can filter the
+> Versions tab on `agentops:candidate` to separate "abandoned PR
+> candidates" from "deployed versions of record". Downstream consumers
+> that resolve `<agent>` to "latest" should skip versions carrying
+> `agentops:candidate=true`; the supported pinning mechanism remains
+> `foundry-agent.json`, which always points at the deployed-of-record
+> version. AgentOps uses prompt SHAs and git SHAs as the durable
+> identity, not old candidate version numbers.
 
 The dev deploy workflow stages a candidate (same logic), evaluates it,
 summarizes the deployment via `prompt_deploy summarize`, and uploads

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.2}/plugins/agentops/README.md

@@ -46,7 +46,7 @@ skills from the extension/plugin.
 Run this from the repository where you want skills checked in:
 
 ```bash
-python -m pip install "agentops-accelerator[foundry] @ git+https://github.com/Azure/agentops.git@main"
+python -m pip install "agentops-accelerator @ git+https://github.com/Azure/agentops.git@main"
 agentops skills install --platform copilot --force
 ```
 

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.2}/plugins/agentops/package.json

@@ -2,7 +2,7 @@
   "name": "agentops-accelerator",
   "displayName": "AgentOps Accelerator — Skills for GitHub Copilot",
   "description": "Copilot agent skills for running standardized evaluation workflows with AgentOps Accelerator and Microsoft Foundry agents.",
-  "version": "0.3.23",
+  "version": "0.4.1",
   "publisher": "AgentOpsAccelerator",
   "icon": "icon.png",
   "license": "MIT",

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.2}/plugins/agentops/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agentops-accelerator",
   "description": "Copilot agent skills for running standardized evaluation workflows with AgentOps Accelerator and Microsoft Foundry agents.",
-  "version": "0.3.23",
+  "version": "0.4.1",
   "author": {
     "name": "AgentOps Accelerator",
     "url": "https://github.com/Azure/agentops"

{agentops_accelerator-0.3.23/src/agentops/templates → agentops_accelerator-0.4.2/plugins/agentops}/skills/agentops-config/SKILL.md

@@ -17,7 +17,7 @@ then return here once there is a `name:version` or URL.
 
 ## Step 0 - Prerequisites
 
-1. `pip install "agentops-accelerator[foundry] @ git+https://github.com/Azure/agentops.git@main"` if `agentops` is missing.
+1. `pip install "agentops-accelerator @ git+https://github.com/Azure/agentops.git@main"` if `agentops` is missing.
 2. Run `agentops eval analyze` first. If it reports missing or ambiguous
    target/dataset/scenario signals, use this skill to adapt the config.
 3. If `agentops.yaml` does not exist, run `agentops init` first. The init

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.2}/plugins/agentops/skills/agentops-eval/SKILL.md

@@ -15,7 +15,7 @@ with a `name:version` or URL.
 
 ## Step 0 - Setup
 
-1. Install if missing: `pip install "agentops-accelerator[foundry] @ git+https://github.com/Azure/agentops.git@main"`.
+1. Install if missing: `pip install "agentops-accelerator @ git+https://github.com/Azure/agentops.git@main"`.
 2. If `agentops.yaml` does not exist at the project root, run `agentops init`.
    The init wizard prompts (azd-style) for the Foundry project endpoint,
    agent reference, and dataset path, persists each answer to

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.2}/pyproject.toml

@@ -13,28 +13,27 @@ dependencies = [
   "pydantic>=2,<3",
   "ruamel.yaml>=0.18,<1.0",
   "azure-ai-projects>=2.0.1,<3.0",
+  "azure-ai-evaluation>=1.0,<2.0",
+  "azure-identity>=1.17,<2.0",
+  "azure-monitor-opentelemetry>=1.6,<2.0",
+  "pandas>=2.0,<4.0",
 ]
 license = { file = "LICENSE" }
 
 [project.optional-dependencies]
 mcp = ["mcp>=1.0,<2"]
-foundry = [
-  "azure-ai-evaluation>=1.0,<2.0",
-  "azure-identity>=1.17,<2.0",
-  "azure-monitor-opentelemetry>=1.6,<2.0",
-  "pandas>=2.0,<3.0",
-]
 agent = [
   "fastapi>=0.110,<1.0",
   "uvicorn[standard]>=0.30,<1.0",
   "httpx>=0.27,<1.0",
   "cryptography>=42",
   "markdown>=3.6,<4.0",
-  "azure-monitor-query>=1.3,<2.0",
+  "azure-monitor-query>=1.3,<3.0",
   "azure-monitor-opentelemetry>=1.6,<2.0",
   "azure-identity>=1.17,<2.0",
-  "azure-mgmt-cognitiveservices>=13.5,<14.0",
+  "azure-mgmt-cognitiveservices>=13.5,<15.0",
   "azure-mgmt-monitor>=6.0,<7.0",
+  "azure-mgmt-authorization>=4.0,<5.0",
 ]
 
 [project.scripts]
@@ -67,6 +66,7 @@ where = ["src"]
 [dependency-groups]
 dev = [
     "azure-ai-evaluation>=1.0,<2.0",
+    "azure-mgmt-authorization>=4.0,<5.0",
     "mypy>=1.19.1",
     "pre-commit>=4.0",
     "pytest>=8.0",

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.2}/src/agentops/agent/analyzer.py

@@ -16,6 +16,9 @@ from agentops.agent.checks.observability import run_observability_check
 from agentops.agent.checks.opex_workspace import run_opex_workspace_check
 from agentops.agent.checks.opex import run_opex_check
 from agentops.agent.checks.posture import run_posture_check
+from agentops.agent.checks.rbac_openai_data_plane import (
+    run_rbac_openai_data_plane_check,
+)
 from agentops.agent.checks.regression import run_regression_check
 from agentops.agent.checks.release_readiness import run_release_readiness_check
 from agentops.agent.checks.safety import run_safety_check
@@ -145,6 +148,7 @@ def analyze(
     findings.extend(run_errors_check(monitor, foundry, config.checks.errors))
     findings.extend(run_safety_check(history, config.checks.safety, monitor, foundry))
     findings.extend(run_posture_check(resources, posture_config))
+    findings.extend(run_rbac_openai_data_plane_check(resources))
     findings.extend(run_opex_workspace_check(workspace))
     findings.extend(run_governance_check(workspace))
     findings.extend(run_observability_check(workspace))

agentops_accelerator-0.4.2/src/agentops/agent/checks/_rbac_authorization.py

@@ -0,0 +1,118 @@
+"""Lazy Azure SDK glue for the ``rbac_openai_data_plane`` Doctor check.
+
+Kept in a private module so the parent check can attempt the lazy
+import in a single place and stay silent when ``azure-identity`` /
+``azure-mgmt-authorization`` are not installed. All errors that should
+make the check skip are normalised into :class:`AuthorizationCheckError`.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import List
+
+log = logging.getLogger(__name__)
+
+
+class AuthorizationCheckError(RuntimeError):
+    """Raised when the RBAC check cannot run for an environmental reason."""
+
+
+def resolve_signed_in_principal_object_id() -> str:
+    """Return the ``oid`` claim of the shared Azure credential's access token.
+
+    Raises :class:`AuthorizationCheckError` when the credential chain cannot
+    return a token, or when the token does not expose an ``oid`` claim.
+    """
+    try:
+        from agentops.agent.sources._credentials import (
+            format_source_error,
+            get_shared_credential,
+        )
+    except ImportError as exc:  # pragma: no cover - shipped together
+        raise AuthorizationCheckError(
+            f"shared credential factory unavailable: {exc}"
+        ) from exc
+
+    try:
+        credential = get_shared_credential(process_timeout=30)
+        token = credential.get_token("https://management.azure.com/.default")
+    except Exception as exc:  # noqa: BLE001 - normalised to skip-error
+        raise AuthorizationCheckError(format_source_error(exc)) from exc
+
+    from agentops.agent.checks.rbac_openai_data_plane import decode_oid_from_jwt
+
+    oid = decode_oid_from_jwt(getattr(token, "token", "") or "")
+    if not oid:
+        raise AuthorizationCheckError(
+            "access token did not include an 'oid' claim; cannot identify "
+            "the signed-in principal"
+        )
+    return oid
+
+
+def list_principal_role_definition_ids(
+    *,
+    subscription_id: str,
+    scope: str,
+    principal_object_id: str,
+) -> List[str]:
+    """List role definition GUIDs assigned to the principal at/above scope.
+
+    Uses ``RoleAssignmentsOperations.list_for_scope`` with the
+    ``atScopeAndAbove() and assignedTo('<oid>')`` filter so management-plane
+    inheritance (subscription, resource group, account) is honoured.
+    """
+    try:
+        from azure.mgmt.authorization import AuthorizationManagementClient
+    except ImportError as exc:
+        raise AuthorizationCheckError(
+            "azure-mgmt-authorization not installed; install "
+            "`agentops-accelerator[agent]` (or add the package directly) to "
+            "enable the OpenAI data-plane RBAC check"
+        ) from exc
+
+    try:
+        from agentops.agent.sources._credentials import (
+            format_source_error,
+            get_shared_credential,
+        )
+    except ImportError as exc:  # pragma: no cover - shipped together
+        raise AuthorizationCheckError(
+            f"shared credential factory unavailable: {exc}"
+        ) from exc
+
+    try:
+        credential = get_shared_credential(process_timeout=30)
+        client = AuthorizationManagementClient(
+            credential=credential,
+            subscription_id=subscription_id,
+        )
+    except Exception as exc:  # noqa: BLE001
+        raise AuthorizationCheckError(format_source_error(exc)) from exc
+
+    try:
+        assignments = list(
+            client.role_assignments.list_for_scope(
+                scope=scope,
+                filter=(
+                    f"atScopeAndAbove() and assignedTo('{principal_object_id}')"
+                ),
+            )
+        )
+    except Exception as exc:  # noqa: BLE001
+        raise AuthorizationCheckError(format_source_error(exc)) from exc
+
+    role_definition_ids: List[str] = []
+    for assignment in assignments:
+        rd_id = (
+            getattr(assignment, "role_definition_id", None)
+            or getattr(getattr(assignment, "properties", None), "role_definition_id", None)
+        )
+        if not rd_id:
+            continue
+        # role_definition_id is a full ARM id ending in `/<guid>`.
+        guid = rd_id.rstrip("/").rsplit("/", 1)[-1]
+        if guid:
+            role_definition_ids.append(guid)
+    return role_definition_ids

{agentops_accelerator-0.3.23 → agentops_accelerator-0.4.2}/src/agentops/agent/checks/foundry_config.py

@@ -60,7 +60,7 @@ def _no_foundry_control_finding(diag: dict) -> Finding:
         recommendation=(
             "Set `sources.foundry_control.project_endpoint` (or the "
             "`AZURE_AI_FOUNDRY_PROJECT_ENDPOINT` env var) in "
-            "`.agentops/agent.yaml`, install the `[foundry]` extra, "
+            "`.agentops/agent.yaml`, install AgentOps, "
             "and grant the running identity at least `Reader` on the "
             "Foundry project. If this project does not use Foundry, "
             "set `sources.foundry_control.enabled: false` to opt out "