fix(agent-os): detect context-cued bare SSNs in redactor and adapter PII patterns - #3801
Open
dylanyunlon wants to merge 1 commit into
Open
fix(agent-os): detect context-cued bare SSNs in redactor and adapter PII patterns#3801dylanyunlon wants to merge 1 commit into
dylanyunlon wants to merge 1 commit into
Conversation
…PII patterns
CredentialRedactor.PII_PATTERNS and integrations.base.PII_PATTERNS both
require a separator between digit groups so that bare nine-digit numbers
(tracking numbers, ZIP+4, ABA routing numbers) do not hard-block at the
MCP gateway. That requirement also lets a genuine SSN through when it
is written without separators next to an explicit cue:
SSN: 745102386
ssn=745102386
social security number 745102386
Add a "US SSN (context-cued)" pattern to both detection sites. The
pattern fires only when a case-insensitive cue keyword (ssn, social
security, social security number/num/no/#, soc sec) appears immediately
before the nine-digit run, keeping uncued bare digits as non-matches so
the false-positive suppression from microsoft#3531 is preserved. Both detectors
carry the identical regex to stay in lockstep (microsoft#3591 tracks their
alignment).
Call chain (2 entry points, 2 source files, 2 test files):
CredentialRedactor.find_pii_matches()
-> PII_PATTERNS["US SSN (context-cued)"].pattern
adapter PII scan (autogen/bedrock)
-> integrations.base.PII_PATTERNS[1]
18 new tests across test_credential_redactor.py (11 positive, 6
negative, 1 matched_text assertion) and test_pii_patterns.py (5
positive, 4 negative).
Closes microsoft#3592
Signed-off-by: dylanyunlon <dogechat@163.com>
dylanyunlon
requested review from
MohammadHaroonAbuomar and
liamcrumm
as code owners
August 21, 2026 04:44
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
github-actions
Bot
added
documentation
|
🟡 Contributor Check: MEDIUM
Automated check by AGT Contributor Check. |
github-actions
Bot
added
the
needs-review:MEDIUM
PR Review Summary
Verdict: AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3592
Problem
CredentialRedactor.PII_PATTERNSandintegrations.base.PII_PATTERNSboth require a separator between digit groups so that bare nine-digit numbers (tracking numbers, ZIP+4, ABA routing numbers) do not hard-block at the MCP gateway. That requirement also lets a genuine SSN through when it is written without separators next to an explicit cue:SSN: 745102386ssn=745102386social security number 745102386None of these match at either detector today (verified against both patterns), so tool output carrying a cued bare SSN is neither redacted at the gateway nor blocked by the adapters.
Fix
Add a "US SSN (context-cued)" pattern to both detection sites. The pattern fires only when a case-insensitive cue keyword (
ssn,social security,social security number/num/no/#,soc sec) appears immediately before the nine-digit run, keeping uncued bare digits as non-matches so the false-positive suppression from #3531 is preserved. Both detectors carry the identical regex to stay in lockstep (#3591 tracks their alignment).Call chain (2 entry points, 2 source files, 2 test files)
CredentialRedactor.find_pii_matches()PII_PATTERNS["US SSN (context-cued)"].patternintegrations.base.PII_PATTERNS[1]Files changed (5)
agent-governance-python/agent-os/src/agent_os/credential_redactor.pyUS SSN (context-cued)CredentialPattern with cue-anchored regexagent-governance-python/agent-os/src/agent_os/integrations/base.pyPII_PATTERNStuple (index 1)agent-governance-python/agent-os/tests/test_credential_redactor.pyagent-governance-python/agent-os/tests/test_pii_patterns.pyCHANGELOG.md### Fixedentry under[Unreleased]Tests
18 new tests over the two detection call chains:
test_context_cued_bare_ssn_is_detected(11 tests): every cue variant from the issue (SSN:,ssn=,social security number,Social Security,soc sec,socsec, etc.) with a bare nine-digit run.test_context_cued_ssn_does_not_match_uncued_bare_digits(6 tests): uncued bare digits (tracking numbers, invoices, routing numbers, phone-like) are NOT matched — preserves fix(agent-os): detect separated SSN forms without matching bare nine digits #3531 FP suppression.test_context_cued_ssn_match_captures_digits_only(1 test): the matched_text includes the digit run for redaction.test_shared_context_cued_ssn_matches_cued_bare_digits(5 tests): adapter-side PII_PATTERNS[1] matches cued forms.test_shared_context_cued_ssn_rejects_uncued_bare_digits(4 tests): adapter-side pattern rejects uncued forms.All 125 existing + new tests pass.
Signed-off-by: dylanyunlon dogechat@163.com