deepintshield 2.0.0__tar.gz → 2.2.0__tar.gz

{deepintshield-2.0.0/src/deepintshield.egg-info → deepintshield-2.2.0}/PKG-INFO

@@ -1,11 +1,13 @@
 Metadata-Version: 2.4
 Name: deepintshield
-Version: 2.0.0
+Version: 2.2.0
 Summary: Unified Python SDK for routing chat, RAG, agentic tool-gating, identity, and MCP traffic through DeepintShield — drop-in across the top agentic frameworks.
 Author: DeepintShield
 License: Apache-2.0
 Project-URL: Homepage, https://app.deepintshield.com
 Project-URL: Documentation, https://app.deepintshield.com/docs
+Project-URL: Examples, https://github.com/deepintai/DeepintShieldFull/tree/develop/deepintshield/examples
+Project-URL: Source, https://github.com/deepintai/DeepintShieldFull/tree/develop/deepintshield
 Keywords: llm,agent,security,guardrails,pep,pdp,agentic,deepintshield,entra,langgraph,crewai
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -311,24 +313,89 @@ runs `decide()` first and the verdict maps to a Python outcome — `ALLOW` runs
 the body, `MASK` redacts PII kwargs, `REQUIRE_APPROVAL` blocks for a human, and
 `DENY` raises `GuardrailDenied`.
 
+### Zero extra code — enforcement is automatic and non-bypassable
+
+The moment you construct `DeepintShield(...)`, the SDK installs guards for every
+agent framework you've imported (LangGraph, CrewAI, LlamaIndex, AutoGen,
+PydanticAI, the OpenAI Agents SDK, LiteLLM). After that, **compiling / building
+an agent yields an already-governed object** — you can't forget to gate it and
+you can't bypass it by invoking the un-governed one (there isn't one).
+
 ```python
-@shield.agentic.tool("db.write", recovery_cost="high")
-def write_ledger(row: dict) -> dict:
-    return db.execute("INSERT INTO ledger …", row)
+from langgraph.graph import StateGraph, START, END
+from deepintshield import DeepintShield, GuardrailDenied
 
-# Or a direct decision probe:
-decision = shield.agentic.decide(tool="db.write", args={"amount": 12})
+shield = DeepintShield.from_env()      # ← guards install here; that's the only line
+
+def crm_read(s):  ...                  # your plain tools/nodes, unchanged
+def admin_grant(s): ...
+
+g = StateGraph(State)
+g.add_node("read_step", crm_read)
+g.add_node("admin_step", admin_grant)
+...
+app = g.compile()                      # auto-governed — every node now gated by the PDP
+
+app.invoke({...})                      # a DENY raises GuardrailDenied before the node runs
+```
+
+If you import a framework *after* building the client, call
+`shield.agentic.enforce()` once to (re)install the guards.
+
+> **Security follows the implementation, not the label.** Each node/tool is
+> governed by its **function name** (`crm_read`), not the node label
+> (`read_step`), and the decision is bound to a fingerprint of the function's
+> **source** — so editing the body is detected and policies target `crm_read`.
+>
+> **Trust boundary:** these client guards are cooperative defense-in-depth. A
+> determined process can un-patch them or call a tool's raw function, so the
+> gateway (MCP / LLM in the call path) remains the authoritative boundary.
+
+### `govern()` — register + threat-scan + instrument (explicit, idempotent)
+
+`govern()` does everything the auto-guard does, explicitly: it **describes** the
+agent's declared tool surface, **registers** that blueprint with the server
+(which **threat-scans each tool's source** for RCE / shell-out / exfiltration —
+OWASP Agentic **T11 / T17** — server-side, ZDR), and **instruments** every call.
+
+```python
+app = shield.agentic.govern(app)       # idempotent — safe alongside the auto-guard
+```
+
+A tool whose source scans malicious is flagged (Agentic → Findings) and, when
+the workspace enables **Enforce code threat** (Rollout), denied — even if a
+policy would otherwise allow it. A tool called but never declared shows up as
+**ASI04 drift** under Agentic → Discovery.
+
+### `guard()` — LangChain callback / in-place instrument
+
+`shield.agentic.guard()` (no argument) returns a native LangChain callback
+handler; attaching it once gates *every* tool the agent calls — the framework
+supplies the tool name and the **gateway resolves the tier, policy, recovery
+cost and identity server-side**.
+
+```python
+guard = shield.agentic.guard()
+agent_executor.invoke({"input": "…"}, config={"callbacks": [guard]})
 ```
 
-Wrap a whole framework's tools in one line:
+`guard(target)` auto-detects and instruments a framework object in place:
 
 ```python
-shield.agentic.langgraph(compiled_graph)   # gate every tool node
-shield.agentic.crewai(tools)               # gate CrewAI BaseTools
-shield.agentic.openai_agents(agent)        # gate FunctionTools on an Agent
-shield.agentic.llamaindex(tools)
-shield.agentic.autogen(agent)
-shield.agentic.pydanticai(agent)
+shield.agentic.guard(compiled_graph)   # LangGraph — gate every tool node
+shield.agentic.guard(crewai_tools)     # CrewAI BaseTools
+shield.agentic.guard(openai_agent)     # OpenAI Agents FunctionTools
+shield.agentic.guard(pydantic_agent)   # PydanticAI agent
+```
+
+### Explicit decorator / decision probe
+
+```python
+@shield.agentic.tool("db.write")
+def write_ledger(row: dict) -> dict:
+    return db.execute("INSERT INTO ledger …", row)
+
+decision = shield.agentic.decide(tool="db.write", args={"amount": 12})
 ```
 
 ```python
@@ -340,6 +407,28 @@ except GuardrailDenied as e:
     log.warning("denied: %s (decision_id=%s)", e.reason, e.decision_id)
 ```
 
+### Optional risk signals (OWASP Agentic gap operands)
+
+For threats only your app can observe, pass an ABAC signal on a `decide()` and
+author a policy on it (one-click templates ship under **Agentic → Templates**):
+
+| Signal | Threat | Policy operand |
+| --- | --- | --- |
+| `memory_integrity` | T1 Memory Poisoning | `memory_integrity eq true` |
+| `hallucination_risk` | T5 Cascading Hallucination | `hallucination_risk gte 0.8` |
+| `goal_drift` | T7 Misaligned & Deceptive | `goal_drift eq true` |
+| `comm_integrity` | T12 Agent Comm Poisoning | `comm_integrity eq true` |
+| `delegation_depth` | T14 Human Attacks on MAS | `delegation_depth gt 4` (server-computed) |
+
+```python
+from deepintshield import ContextBag, DelegationContext
+
+shield.agentic.decide(DelegationContext(
+    tool="ledger.post", virtual_key=shield.virtual_key,
+    context=ContextBag(hallucination_risk=0.91, goal_drift=True),
+))
+```
+
 ### Agent identity (zero config)
 
 When the virtual key is bound to an identity provider, the SDK auto-discovers
@@ -381,6 +470,35 @@ app = graph.compile()
 
 ---
 
+## Multimodal guardrails (transparent)
+
+Image generation, image edits, audio (TTS / transcription), video, embedding and
+rerank requests are guarded **at the gateway** — no SDK changes and no extra code.
+Keep using the native provider SDKs through DeepIntShield; when the operator
+enables `GUARDRAILS_MULTIMODAL`, the gateway evaluates the text these requests
+already carry (image/TTS/video prompts, transcripts) and the binary artifacts
+themselves, blocking or flagging per your policies.
+
+```python
+client = shield.openai()
+
+# Guarded automatically — the image prompt is evaluated before generation.
+img = client.images.generate(model="gpt-image-1", prompt="a serene mountain lake")
+
+# A blocked prompt surfaces as the provider SDK's normal HTTP error:
+from deepintshield import DeepintShieldError
+try:
+    client.audio.speech.create(model="tts-1", voice="alloy", input="<disallowed text>")
+except DeepintShieldError as exc:
+    print(exc.status_code, exc.payload)   # 403 guardrail_blocked
+```
+
+For an explicit verdict (rather than transparent enforcement), `evaluate_guardrail`
+returns a `GuardrailResult`; `result.mode` reports whether the verdict was
+enforcing (`sync`) or observe-only (`shadow`).
+
+---
+
 ## MCP
 
 Generic MCP support — works with any server connected to your DeepintShield
@@ -537,5 +655,5 @@ the client.
 
 ## More examples
 
-See [examples/](examples/) for runnable per-provider chat, RAG, agent, and MCP
+See [examples/](https://github.com/deepintai/DeepintShieldFull/tree/develop/deepintshield/examples) for runnable per-provider chat, RAG, agent, and MCP
 scripts.

{deepintshield-2.0.0 → deepintshield-2.2.0}/README.md

@@ -242,24 +242,89 @@ runs `decide()` first and the verdict maps to a Python outcome — `ALLOW` runs
 the body, `MASK` redacts PII kwargs, `REQUIRE_APPROVAL` blocks for a human, and
 `DENY` raises `GuardrailDenied`.
 
+### Zero extra code — enforcement is automatic and non-bypassable
+
+The moment you construct `DeepintShield(...)`, the SDK installs guards for every
+agent framework you've imported (LangGraph, CrewAI, LlamaIndex, AutoGen,
+PydanticAI, the OpenAI Agents SDK, LiteLLM). After that, **compiling / building
+an agent yields an already-governed object** — you can't forget to gate it and
+you can't bypass it by invoking the un-governed one (there isn't one).
+
 ```python
-@shield.agentic.tool("db.write", recovery_cost="high")
-def write_ledger(row: dict) -> dict:
-    return db.execute("INSERT INTO ledger …", row)
+from langgraph.graph import StateGraph, START, END
+from deepintshield import DeepintShield, GuardrailDenied
 
-# Or a direct decision probe:
-decision = shield.agentic.decide(tool="db.write", args={"amount": 12})
+shield = DeepintShield.from_env()      # ← guards install here; that's the only line
+
+def crm_read(s):  ...                  # your plain tools/nodes, unchanged
+def admin_grant(s): ...
+
+g = StateGraph(State)
+g.add_node("read_step", crm_read)
+g.add_node("admin_step", admin_grant)
+...
+app = g.compile()                      # auto-governed — every node now gated by the PDP
+
+app.invoke({...})                      # a DENY raises GuardrailDenied before the node runs
+```
+
+If you import a framework *after* building the client, call
+`shield.agentic.enforce()` once to (re)install the guards.
+
+> **Security follows the implementation, not the label.** Each node/tool is
+> governed by its **function name** (`crm_read`), not the node label
+> (`read_step`), and the decision is bound to a fingerprint of the function's
+> **source** — so editing the body is detected and policies target `crm_read`.
+>
+> **Trust boundary:** these client guards are cooperative defense-in-depth. A
+> determined process can un-patch them or call a tool's raw function, so the
+> gateway (MCP / LLM in the call path) remains the authoritative boundary.
+
+### `govern()` — register + threat-scan + instrument (explicit, idempotent)
+
+`govern()` does everything the auto-guard does, explicitly: it **describes** the
+agent's declared tool surface, **registers** that blueprint with the server
+(which **threat-scans each tool's source** for RCE / shell-out / exfiltration —
+OWASP Agentic **T11 / T17** — server-side, ZDR), and **instruments** every call.
+
+```python
+app = shield.agentic.govern(app)       # idempotent — safe alongside the auto-guard
+```
+
+A tool whose source scans malicious is flagged (Agentic → Findings) and, when
+the workspace enables **Enforce code threat** (Rollout), denied — even if a
+policy would otherwise allow it. A tool called but never declared shows up as
+**ASI04 drift** under Agentic → Discovery.
+
+### `guard()` — LangChain callback / in-place instrument
+
+`shield.agentic.guard()` (no argument) returns a native LangChain callback
+handler; attaching it once gates *every* tool the agent calls — the framework
+supplies the tool name and the **gateway resolves the tier, policy, recovery
+cost and identity server-side**.
+
+```python
+guard = shield.agentic.guard()
+agent_executor.invoke({"input": "…"}, config={"callbacks": [guard]})
 ```
 
-Wrap a whole framework's tools in one line:
+`guard(target)` auto-detects and instruments a framework object in place:
 
 ```python
-shield.agentic.langgraph(compiled_graph)   # gate every tool node
-shield.agentic.crewai(tools)               # gate CrewAI BaseTools
-shield.agentic.openai_agents(agent)        # gate FunctionTools on an Agent
-shield.agentic.llamaindex(tools)
-shield.agentic.autogen(agent)
-shield.agentic.pydanticai(agent)
+shield.agentic.guard(compiled_graph)   # LangGraph — gate every tool node
+shield.agentic.guard(crewai_tools)     # CrewAI BaseTools
+shield.agentic.guard(openai_agent)     # OpenAI Agents FunctionTools
+shield.agentic.guard(pydantic_agent)   # PydanticAI agent
+```
+
+### Explicit decorator / decision probe
+
+```python
+@shield.agentic.tool("db.write")
+def write_ledger(row: dict) -> dict:
+    return db.execute("INSERT INTO ledger …", row)
+
+decision = shield.agentic.decide(tool="db.write", args={"amount": 12})
 ```
 
 ```python
@@ -271,6 +336,28 @@ except GuardrailDenied as e:
     log.warning("denied: %s (decision_id=%s)", e.reason, e.decision_id)
 ```
 
+### Optional risk signals (OWASP Agentic gap operands)
+
+For threats only your app can observe, pass an ABAC signal on a `decide()` and
+author a policy on it (one-click templates ship under **Agentic → Templates**):
+
+| Signal | Threat | Policy operand |
+| --- | --- | --- |
+| `memory_integrity` | T1 Memory Poisoning | `memory_integrity eq true` |
+| `hallucination_risk` | T5 Cascading Hallucination | `hallucination_risk gte 0.8` |
+| `goal_drift` | T7 Misaligned & Deceptive | `goal_drift eq true` |
+| `comm_integrity` | T12 Agent Comm Poisoning | `comm_integrity eq true` |
+| `delegation_depth` | T14 Human Attacks on MAS | `delegation_depth gt 4` (server-computed) |
+
+```python
+from deepintshield import ContextBag, DelegationContext
+
+shield.agentic.decide(DelegationContext(
+    tool="ledger.post", virtual_key=shield.virtual_key,
+    context=ContextBag(hallucination_risk=0.91, goal_drift=True),
+))
+```
+
 ### Agent identity (zero config)
 
 When the virtual key is bound to an identity provider, the SDK auto-discovers
@@ -312,6 +399,35 @@ app = graph.compile()
 
 ---
 
+## Multimodal guardrails (transparent)
+
+Image generation, image edits, audio (TTS / transcription), video, embedding and
+rerank requests are guarded **at the gateway** — no SDK changes and no extra code.
+Keep using the native provider SDKs through DeepIntShield; when the operator
+enables `GUARDRAILS_MULTIMODAL`, the gateway evaluates the text these requests
+already carry (image/TTS/video prompts, transcripts) and the binary artifacts
+themselves, blocking or flagging per your policies.
+
+```python
+client = shield.openai()
+
+# Guarded automatically — the image prompt is evaluated before generation.
+img = client.images.generate(model="gpt-image-1", prompt="a serene mountain lake")
+
+# A blocked prompt surfaces as the provider SDK's normal HTTP error:
+from deepintshield import DeepintShieldError
+try:
+    client.audio.speech.create(model="tts-1", voice="alloy", input="<disallowed text>")
+except DeepintShieldError as exc:
+    print(exc.status_code, exc.payload)   # 403 guardrail_blocked
+```
+
+For an explicit verdict (rather than transparent enforcement), `evaluate_guardrail`
+returns a `GuardrailResult`; `result.mode` reports whether the verdict was
+enforcing (`sync`) or observe-only (`shadow`).
+
+---
+
 ## MCP
 
 Generic MCP support — works with any server connected to your DeepintShield
@@ -468,5 +584,5 @@ the client.
 
 ## More examples
 
-See [examples/](examples/) for runnable per-provider chat, RAG, agent, and MCP
+See [examples/](https://github.com/deepintai/DeepintShieldFull/tree/develop/deepintshield/examples) for runnable per-provider chat, RAG, agent, and MCP
 scripts.

{deepintshield-2.0.0 → deepintshield-2.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "deepintshield"
-version = "2.0.0"
+version = "2.2.0"
 description = "Unified Python SDK for routing chat, RAG, agentic tool-gating, identity, and MCP traffic through DeepintShield — drop-in across the top agentic frameworks."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -64,6 +64,8 @@ dev = [
 [project.urls]
 Homepage = "https://app.deepintshield.com"
 Documentation = "https://app.deepintshield.com/docs"
+Examples = "https://github.com/deepintai/DeepintShieldFull/tree/develop/deepintshield/examples"
+Source = "https://github.com/deepintai/DeepintShieldFull/tree/develop/deepintshield"
 
 [tool.setuptools]
 package-dir = { "" = "src" }

deepintshield-2.2.0/src/deepintshield/agentic/enforcement.py

@@ -0,0 +1,63 @@
+"""Non-bypassable enforcement installer for every supported framework.
+
+The per-framework adapters gate tools *when the developer calls* ``govern()`` /
+``guard()``. That still leaves a gap: nothing stops code from skipping that call
+and running the agent directly. ``install_all`` closes it by monkey-patching each
+framework's build/execute boundary the moment a DeepintShield client is created,
+so a tool/graph can't run ungoverned — the developer no longer has to remember.
+
+Design rules every framework installer follows:
+  * **Lazy engine** — takes a ``get_engine`` callable resolved on first use, so
+    installing at client construction never forces the agentic surface to build.
+  * **Only if imported** — we patch a framework only when it's already in
+    ``sys.modules`` (never force-import a dep the user isn't using).
+  * **Idempotent** — re-installing re-binds the provider, never double-wraps.
+  * **Fail-open on infra, fail-CLOSED on a verdict** — a gateway hiccup must not
+    break the app, but a DENY must still block. Each installer swallows
+    infrastructure errors and re-raises ``GuardrailDenied`` / approval timeouts.
+
+Cooperative defense-in-depth: a determined process can un-patch these or call a
+tool's raw function object, so the gateway (MCP/LLM in the call path) stays the
+authoritative boundary. For ordinary application code this makes enforcement the
+default rather than something to remember.
+"""
+
+from __future__ import annotations
+
+import sys
+from importlib import import_module
+from typing import Any, Callable
+
+# top-level import name → enforcement integration module (relative to this package)
+_FRAMEWORKS: list[tuple[str, str]] = [
+    ("langgraph", ".integrations.langgraph"),
+    ("crewai", ".integrations.crewai"),
+    ("llama_index", ".integrations.llamaindex"),
+    ("autogen", ".integrations.autogen"),
+    ("autogen_core", ".integrations.autogen"),
+    ("pydantic_ai", ".integrations.pydanticai"),
+    ("agents", ".integrations.openai_agents"),  # `openai-agents` imports as `agents`
+    ("litellm", ".integrations.litellm"),
+]
+
+
+def install_all(get_engine: Callable[[], Any]) -> list[str]:
+    """Install enforcement guards for every supported framework currently
+    imported. Returns the list of frameworks guarded. Never raises."""
+    installed: list[str] = []
+    seen: set[str] = set()
+    for mod_name, integ in _FRAMEWORKS:
+        if mod_name not in sys.modules or integ in seen:
+            continue
+        seen.add(integ)
+        try:
+            m = import_module(integ, package=__package__)
+            fn = getattr(m, "enforce", None)
+            if callable(fn) and fn(get_engine):
+                installed.append(mod_name)
+        except Exception:  # a single framework's guard never blocks the others
+            continue
+    return installed
+
+
+__all__ = ["install_all"]

{deepintshield-2.0.0 → deepintshield-2.2.0}/src/deepintshield/agentic/engine.py

@@ -23,6 +23,7 @@ from __future__ import annotations
 import logging
 import os
 import time
+import uuid
 from typing import TYPE_CHECKING, Optional
 
 import httpx
@@ -57,6 +58,11 @@ class AgenticEngine:
         self._agent_credential: Optional[AgentCredential] = agent_credential
         self._approval_timeout = approval_poll_timeout_seconds
         self._approval_interval = approval_poll_interval_seconds
+        # Per-process run id (OTel/Langfuse style). Stamped on every decide so all
+        # of this client's steps group into ONE Agent Execution; a fresh process
+        # (new engine) → a new execution. Override per call via dc.session_id, or
+        # set engine.session_id to bind a longer-lived agent run to one execution.
+        self.session_id: str = "sdk-" + uuid.uuid4().hex[:12]
 
     # ──────────────────────────────────────────────────────────────────
     # Parent-backed connection details
@@ -117,6 +123,10 @@ class AgenticEngine:
 
         Retries once with fresh discovery info on 401/403 to handle the case
         where a platform admin re-bound the VK mid-process."""
+        # Stamp the per-process session id unless the caller set their own, so
+        # the run's steps group into one execution server-side.
+        if not dc.session_id:
+            dc.session_id = self.session_id
         try:
             return self._post_decide(dc)
         except GatewayUnavailable:
@@ -130,6 +140,34 @@ class AgenticEngine:
                 return self._post_decide(dc)
             raise
 
+    def register_blueprint(self, manifest: object) -> Optional[str]:
+        """Register the agent's declared tool surface (manifest) with the server
+        BEFORE the run — the server stores the declared topology for full-graph
+        visualization, policy pre-validation, and declared-vs-observed drift.
+
+        Best-effort and NON-fatal: a registration failure (offline gateway, older
+        server) must never break the agent, so this never raises. Returns the
+        server-assigned blueprint id, or None."""
+        try:
+            payload = manifest.to_dict() if hasattr(manifest, "to_dict") else manifest
+            # Stamp the per-process session + principal so the blueprint binds to
+            # the same execution the decisions will carry.
+            if isinstance(payload, dict):
+                payload.setdefault("session_id", self.session_id)
+            resp = self._http.post(
+                f"{self.gateway_url}/api/agentic-security/blueprints",
+                json=payload,
+                headers=self._headers(include_agent_token=False),
+            )
+            if resp.status_code < 300:
+                try:
+                    return resp.json().get("blueprint_id")
+                except Exception:
+                    return None
+        except Exception as exc:  # never break the run on a registration hiccup
+            log.warning("blueprint registration skipped: %s", exc)
+        return None
+
     def poll_approval(self, decision_id: str) -> Decision:
         """Block waiting for a REQUIRE_APPROVAL decision to be resolved by a
         human. Returns the final Decision (ALLOW or DENY)."""
@@ -140,10 +178,16 @@ class AgenticEngine:
                 headers=self._headers(include_agent_token=False),
             )
             if resp.status_code == 200:
-                state = resp.json().get("state", "pending")
+                # Be defensive: a transient/non-JSON body (proxy error page, SPA
+                # fallback) must not crash the poll — treat it as "still pending"
+                # and keep waiting until the deadline (→ GuardrailApprovalPending).
+                try:
+                    state = resp.json().get("state", "pending")
+                except Exception:  # noqa: BLE001
+                    state = "pending"
                 if state == "approved":
                     return Decision(verdict=Verdict.ALLOW, decision_id=decision_id)
-                if state == "denied":
+                if state in ("denied", "expired"):
                     return Decision(
                         verdict=Verdict.DENY,
                         decision_id=decision_id,

{deepintshield-2.0.0 → deepintshield-2.2.0}/src/deepintshield/agentic/gate.py

@@ -31,6 +31,7 @@ def resolve(
     *,
     recovery_cost: str = "",
     rag_provenance: str = "",
+    tool_fingerprint: str = "",
 ) -> Decision:
     """Run a PDP decision for ``tool_name`` and raise on any blocking verdict.
 
@@ -43,7 +44,20 @@ def resolve(
         tool=tool_name,
         args_digest=digest(args, kwargs),
         virtual_key=engine.virtual_key,
-        context=ContextBag(recovery_cost=recovery_cost, rag_provenance=rag_provenance),
+        # PDP subject matchers are authored against an agent role
+        # (any_role: ["agent", ...]); the decorator/adapter caller doesn't
+        # spell out an identity. Carry a default agent principal + actor_chain
+        # so role-scoped policies match the decorator path the same way they
+        # match an explicitly-populated DelegationContext. The server only
+        # synthesises this for agent-bound VKs; LLM-only VKs need it from here.
+        principal="agent:sdk",
+        actor_chain=["agent:sdk"],
+        identity_type="application",
+        context=ContextBag(
+            recovery_cost=recovery_cost,
+            rag_provenance=rag_provenance,
+            tool_fingerprint=tool_fingerprint,
+        ),
     )
     decision = engine.decide(dc)
 
@@ -81,6 +95,7 @@ def enforce(
     *,
     recovery_cost: str = "",
     rag_provenance: str = "",
+    tool_fingerprint: str = "",
 ) -> dict[str, Any]:
     """``resolve`` + apply MASK obligations to ``kwargs``.
 
@@ -93,6 +108,7 @@ def enforce(
         kwargs,
         recovery_cost=recovery_cost,
         rag_provenance=rag_provenance,
+        tool_fingerprint=tool_fingerprint,
     )
     return apply_obligations(kwargs, decision.obligations)