Promote EU AI Act risk classifier from examples to library

[atharvajoshi01]

Summary

Closes #756. Moves the EU AI Act risk classifier from examples/06-eu-ai-act-compliance/ into the agentmesh.governance library as EUAIActRiskClassifier.

What changed

New files:

• governance/eu_ai_act.py -- EUAIActRiskClassifier with structured risk assessment
• governance/eu_ai_act_defaults.yaml -- configurable risk categories (Annex I, III, Art. 5, Art. 6(3))
• tests/governance/test_eu_ai_act.py -- 24 tests covering all classification paths

Modified:

• governance/__init__.py -- exports RiskLevel, AgentRiskProfile, ClassificationResult, EUAIActRiskClassifier

Features added per issue requirements

1. Art. 5 prohibited practices detection
2. Art. 6(1) Annex I safety-component path (harmonisation legislation)
3. Art. 6(2) Annex III domain-based classification
4. Art. 6(3) exemptions (narrow procedural task, pattern detection, preparatory task, improve prior human activity)
5. Profiling override per GDPR Art. 4(4) -- exemptions do NOT apply when profiling
6. External YAML config so Annex III amendments can be tracked without code changes

Regression fix

The old assess_risk_category() in agent-os used keyword substring matching against str(system_description). A system described as "Rate citizens based on behavior for government rewards" classified as MINIMAL_RISK because no keywords matched. The new classifier uses structured domain mapping and correctly identifies this as UNACCEPTABLE (social scoring).

Test plan

• 24 tests all passing: pytest packages/agent-mesh/tests/governance/test_eu_ai_act.py -v
• Covers: unacceptable risk, Annex I safety components, Annex III domains, capability escalation, Art. 6(3) exemptions, profiling override, limited/minimal risk, domain normalization, regression case

[github-actions]

Welcome to the Agent Governance Toolkit! Thanks for your first pull request.
Please ensure tests pass, code follows style (ruff check), and you have signed the CLA.
See our Contributing Guide.

[github-actions]

🤖 AI Agent: docs-sync-checker — Issues Found

📝 Documentation Sync Report

Issues Found

• ❌ EUAIActRiskClassifier in governance/eu_ai_act.py — missing detailed docstring for the classify method.
• ⚠️ packages/agent-mesh/README.md — no mention of the newly added EUAIActRiskClassifier or its usage.
• ⚠️ CHANGELOG.md — no entry for the addition of the EUAIActRiskClassifier and its related features.
• ⚠️ examples/ — no example added to demonstrate the usage of the new EUAIActRiskClassifier.

Suggestions

• 💡 Add a detailed docstring for the classify method in EUAIActRiskClassifier. Include information about the purpose of the method, its parameters (profile: AgentRiskProfile), return value (ClassificationResult), and any exceptions that might be raised.
• 💡 Update packages/agent-mesh/README.md to include a section about the EUAIActRiskClassifier. Provide a brief overview of its purpose, key features, and a basic usage example.
• 💡 Add an entry to CHANGELOG.md under a new version header, documenting the addition of the EUAIActRiskClassifier and its related features (e.g., structured risk classification, YAML configuration, etc.).
• 💡 Add an example in the examples/ directory to demonstrate how to use the EUAIActRiskClassifier. This example should include creating an AgentRiskProfile, loading a configuration file, and calling the classify method.

Additional Notes

• The new public APIs (EUAIActRiskClassifier, AgentRiskProfile, ClassificationResult, and RiskLevel) are well-documented with class-level docstrings and type annotations, except for the classify method.
• The test coverage for the new functionality appears to be comprehensive, covering various scenarios and edge cases.
• The YAML configuration file (eu_ai_act_defaults.yaml) is well-documented and provides clear guidance for future updates.

Please address the identified issues and suggestions to ensure the documentation is fully synchronized with the new functionality. Let me know if you need further assistance!

[github-actions]

🤖 AI Agent: breaking-change-detector — Summary

🔍 API Compatibility Report

Summary

This pull request introduces a new public API, EUAIActRiskClassifier, along with related classes and configurations for structured risk classification under the EU AI Act. No breaking changes were detected in the existing API. The changes are additive and introduce new functionality.

Findings

Severity	Package	Change	Impact
🔵	agentmesh.governance	Added EUAIActRiskClassifier class	New public API, not breaking
🔵	agentmesh.governance	Added RiskLevel enum	New public API, not breaking
🔵	agentmesh.governance	Added AgentRiskProfile dataclass	New public API, not breaking
🔵	agentmesh.governance	Added ClassificationResult dataclass	New public API, not breaking
🔵	agentmesh.governance	Added eu_ai_act_defaults.yaml for external configuration	New feature, not breaking
🔵	agentmesh.governance	Updated __init__.py to export new classes and enums	New exports, not breaking

Migration Guide

No migration steps are required as no breaking changes were introduced. Downstream users can start using the new EUAIActRiskClassifier and related classes immediately.

Recommendations

1. Documentation: Ensure the new API (EUAIActRiskClassifier, RiskLevel, AgentRiskProfile, ClassificationResult) is well-documented, including usage examples and details about the external configuration file (eu_ai_act_defaults.yaml).
2. Versioning: Consider bumping the minor version of the package to indicate the addition of new features.
3. Changelog: Update the changelog to reflect the new functionality introduced in this pull request.

✅ No breaking changes detected.

[github-actions]

🤖 AI Agent: test-generator — `packages/agent-mesh/src/agentmesh/governance/__init__.py`

🧪 Test Coverage Analysis

packages/agent-mesh/src/agentmesh/governance/__init__.py

• ✅ Existing coverage: The changes in this file are primarily related to exporting new classes and functions (RiskLevel, AgentRiskProfile, ClassificationResult, EUAIActRiskClassifier) from the eu_ai_act.py module. These exports are indirectly covered by the tests in test_eu_ai_act.py, as they rely on these classes and functions being correctly imported and functional.
• ❌ Missing coverage: There are no direct tests for the __init__.py file itself, but this is generally acceptable since its purpose is to manage imports and exports.
• 💡 Suggested test cases: None specifically for this file, as its functionality is indirectly tested through the test_eu_ai_act.py tests.

---

packages/agent-mesh/src/agentmesh/governance/eu_ai_act.py

• ✅ Existing coverage:
  • The EUAIActRiskClassifier and its classify method are extensively tested in test_eu_ai_act.py with 24 test cases.
  • The tests cover:
    • Article 5 prohibited practices (e.g., social scoring, subliminal manipulation).
    • Article 6(1) Annex I safety components.
    • Article 6(2) Annex III high-risk domains.
    • Article 6(3) exemptions and profiling overrides.
    • Capability-based escalation to high risk.
    • Limited and minimal risk classifications.
    • Domain normalization (e.g., case insensitivity, handling spaces/hyphens).
    • Regression for keyword-only matching in the old implementation.
• ❌ Missing coverage:
  • Edge cases for malformed or incomplete AgentRiskProfile inputs.
  • Behavior when the configuration file is missing, corrupted, or contains invalid data.
  • Concurrency scenarios where multiple threads or processes use the classifier simultaneously.
  • Performance under high load or large input profiles.
• 💡 Suggested test cases:
  1. test_missing_config_file — Verify that the classifier raises an appropriate error or falls back to default configuration when the specified config file is missing.
  2. test_corrupted_config_file — Test behavior when the configuration file is corrupted (e.g., invalid YAML/JSON).
  3. test_empty_agent_profile — Ensure that an empty AgentRiskProfile (all fields default) is classified as MINIMAL risk.
  4. test_partial_agent_profile — Test classification when some fields in the AgentRiskProfile are missing or None.
  5. test_large_capabilities_list — Evaluate performance and correctness when the capabilities list in AgentRiskProfile contains hundreds or thousands of entries.
  6. test_concurrent_classifications — Simulate multiple threads or processes using the classifier simultaneously to check for race conditions or shared state issues.
  7. test_invalid_exemption_tags — Test behavior when exemption_tags contains invalid or unexpected values (e.g., non-string types).
  8. test_large_config_file — Verify that the classifier handles a very large configuration file without performance degradation or memory issues.
  9. test_timeout_handling — Simulate a scenario where loading the configuration file or classification logic takes too long, and ensure the system handles it gracefully.
  10. test_injection_attempts_in_profile — Test for robustness against malicious input in AgentRiskProfile fields (e.g., SQL injection-like patterns in description or domain).

---

Summary

The test_eu_ai_act.py file provides excellent coverage for the EUAIActRiskClassifier and its associated logic, addressing most of the core functionality and domain-specific edge cases. However, additional tests focusing on malformed inputs, concurrency, performance, and configuration file handling would further strengthen the robustness and reliability of the implementation.

[github-actions]

🤖 AI Agent: code-reviewer

Review Summary

This PR introduces the EUAIActRiskClassifier to the agentmesh.governance library, promoting it from an example implementation. The classifier is designed to assess AI systems' risk levels under the EU AI Act, incorporating structured domain mapping, exemptions, profiling overrides, and external configuration for future updates. The implementation appears robust and well-tested, with 24 test cases covering various scenarios. However, there are a few areas that require attention to ensure correctness, security, and maintainability.

---

🔴 CRITICAL

1. Lack of Input Validation in AgentRiskProfile

   • The AgentRiskProfile dataclass does not validate its fields, which could lead to incorrect or insecure behavior if invalid data is passed. For example:
     • domain and capabilities are normalized later in the code, but invalid or unexpected formats (e.g., None, empty strings, or non-string types) could cause issues.
     • is_safety_component and involves_profiling are expected to be booleans, but no validation enforces this.
   • Recommendation: Use Pydantic models instead of plain dataclasses for AgentRiskProfile and ClassificationResult. Pydantic provides robust type validation and error handling.

2. Potential YAML Injection Vulnerability

   • The _load_config function uses yaml.safe_load, which is safer than yaml.load, but it still processes external YAML files. If an attacker gains control over the configuration file, they could manipulate risk classifications.
   • Recommendation: Validate the structure and content of the loaded YAML file against a schema to ensure it adheres to expected formats and values.

3. Profiling Override Logic

   • The profiling override logic in classify does not explicitly check whether profile.involves_profiling is a boolean. If this field is accidentally set to a non-boolean value (e.g., a string or None), it could bypass the override logic.
   • Recommendation: Add explicit type checks or use a Pydantic model to enforce type safety.

---

🟡 WARNING

1. Breaking Change in Public API

   • The addition of EUAIActRiskClassifier and its related classes (RiskLevel, AgentRiskProfile, ClassificationResult) to the governance module's public API (__init__.py) introduces new public-facing functionality. While this is intentional, it should be clearly documented in the release notes to inform users of the new API.
   • Recommendation: Add a note in the release documentation about the new public API and its intended usage.

2. Backward Compatibility of Configuration

   • The classifier relies on an external YAML configuration file (eu_ai_act_defaults.yaml). If the structure of this file changes in future updates, it could break existing deployments.
   • Recommendation: Implement versioning for the configuration file and provide backward compatibility mechanisms (e.g., migration scripts or default fallbacks).

---

💡 SUGGESTIONS

1. Thread Safety

   • The EUAIActRiskClassifier appears to be stateless, which is good for thread safety. However, the _load_config function reads from a file, which could cause issues in highly concurrent environments if multiple threads attempt to load the configuration simultaneously.
   • Recommendation: Cache the configuration in memory after the first load to avoid repeated file I/O and potential race conditions.

2. Improved Logging

   • The classifier does not log any information about its decisions or errors. This could make debugging difficult in production environments.
   • Recommendation: Add logging at key decision points (e.g., when a risk level is determined or when an exemption is applied).

3. Normalization Function

   • The _normalize function is used to standardize strings by converting them to lowercase and replacing spaces/hyphens with underscores. While this is effective, it could lead to unintended collisions (e.g., credit scoring and credit-scoring both normalize to credit_scoring).
   • Recommendation: Document the normalization behavior clearly and consider adding a warning or error if collisions are detected in the configuration.

4. Test Coverage

   • The test suite is comprehensive, but it could benefit from additional edge cases:
     • Profiles with empty or invalid fields (e.g., None for domain or capabilities).
     • Profiles with unexpected exemption tags or capabilities.
     • Profiles with conflicting attributes (e.g., a prohibited domain with valid exemptions).
   • Recommendation: Add these edge cases to ensure the classifier handles all scenarios robustly.

5. Documentation

   • The EUAIActRiskClassifier is a significant addition to the library, but its usage and configuration are not documented in this PR.
   • Recommendation: Add detailed documentation for the classifier, including:
     • How to create and validate AgentRiskProfile objects.
     • How to use the classifier in different scenarios.
     • How to customize the YAML configuration file.

---

Conclusion

This PR introduces a well-designed and much-needed feature for EU AI Act compliance. However, there are critical issues related to input validation, YAML security, and profiling logic that must be addressed before merging. Additionally, improvements in thread safety, logging, and documentation would enhance the overall quality and usability of the feature.

[github-actions]

🤖 AI Agent: contributor-guide — 🌟 What You Did Well

Hello there, and welcome to the microsoft/agent-governance-toolkit community! 🎉 Thank you for taking the time to contribute — we’re thrilled to have you here. Your pull request is a fantastic addition to the project, and I can see you’ve put a lot of thought and effort into it. Let’s dive into the review!

---

🌟 What You Did Well

1. Thorough Implementation: Moving the EUAIActRiskClassifier from the examples to the library is a great idea, and you’ve done an excellent job of structuring the code. The use of dataclasses and enums makes the implementation clean and easy to understand.
2. Comprehensive Testing: Including 24 tests that cover a wide range of scenarios is fantastic! It’s clear that you’ve thought through edge cases, such as exemptions, profiling overrides, and domain normalization.
3. Configurable Design: The use of an external YAML configuration file for Annex III amendments is a thoughtful touch. It makes the classifier adaptable to future changes in the EU AI Act without requiring code modifications.
4. Documentation: The docstrings in your code are clear and provide a great explanation of the classifier’s functionality. This will make it much easier for others to understand and use.

---

🛠️ Suggestions for Improvement

1. Code Linting:

   • We use ruff for linting, specifically with the E, F, and W rules enabled. Before we merge, could you run ruff --fix . to ensure the code adheres to our linting standards? This will help us maintain consistency across the codebase.

2. Test Placement:

   • You’ve done a great job with the tests! Just a quick note: in this project, we organize tests under the packages/{name}/tests/ directory. Could you move test_eu_ai_act.py to packages/agent-mesh/tests/governance/ to align with our conventions?

3. Commit Message Style:

   • We follow the Conventional Commits standard. Your PR title is great, but could you update your commit messages to follow the format? For example:
     • feat(governance): promote EU AI Act risk classifier to library
     • test(governance): add tests for EU AI Act risk classifier
     • docs(governance): add docstrings for EU AI Act risk classifier

4. Security Considerations:

   • Since this classifier could be used in security-sensitive contexts, it’s worth adding a note in the documentation about potential risks or limitations. For example, are there any edge cases where the classifier might produce unexpected results? Are there any assumptions about the input data that users should be aware of?

5. Documentation Update:

   • It would be helpful to update the CONTRIBUTING.md or QUICKSTART.md files to include a brief mention of the EUAIActRiskClassifier and how to use it. This will help new users discover and understand this feature.

---

🔗 Helpful Resources

• CONTRIBUTING.md: For guidance on contributing to the project.
• QUICKSTART.md: For an overview of how to get started with the toolkit.
• Ruff Linter: To ensure your code adheres to our linting standards.
• Conventional Commits: For structuring your commit messages.

---

✅ Next Steps

1. Run ruff --fix . to address any linting issues.
2. Move the test file to packages/agent-mesh/tests/governance/.
3. Update your commit messages to follow the Conventional Commits format.
4. Consider adding a note about security considerations in the documentation.
5. Optionally, update the CONTRIBUTING.md or QUICKSTART.md files to include a mention of the new classifier.

Once you’ve made these updates, please push your changes to this branch. I’ll be here to review your updates and help you get this merged!

Thank you again for your contribution — we’re excited to have you as part of the community! 😊

[github-actions]

🤖 AI Agent: security-scanner — Security Review of PR: Promote EU AI Act Risk Classifier to Library

Security Review of PR: Promote EU AI Act Risk Classifier to Library

This PR introduces the EUAIActRiskClassifier into the agentmesh.governance library, promoting it from an example implementation. The classifier is designed to assess AI systems' risk levels according to the EU AI Act, with configurable rules for prohibited practices, high-risk domains, exemptions, and profiling overrides. Below is a security analysis of the changes.

---

Findings

1. Prompt Injection Defense Bypass

• Risk: The classifier does not directly interact with user-provided prompts or natural language inputs, so prompt injection risks are not applicable here.
• Rating: 🔵 LOW

---

2. Policy Engine Circumvention

• Risk: The classifier relies on external YAML/JSON configuration files for its rules. If these files are tampered with, the classification logic could be bypassed or weakened. For example:
  • Removing prohibited domains from unacceptable_domains could allow prohibited practices to pass as acceptable.
  • Adding invalid exemptions to article_6_3_exemptions could improperly downgrade high-risk classifications.
• Attack Vector: An attacker with access to the configuration file could modify it to weaken the policy engine.
• Mitigation:
  • Enforce strict file integrity checks (e.g., hashing or signing) for the configuration files.
  • Validate the configuration file on load to ensure it adheres to expected schemas and contains no invalid or unexpected entries.
• Rating: 🟠 HIGH

---

3. Trust Chain Weaknesses

• Risk: No explicit trust chain validation is implemented for the configuration files. If the configuration file is sourced from an external location, there is a risk of supply chain attacks or tampering.
• Attack Vector: A malicious actor could replace the configuration file with one that weakens the classifier's rules.
• Mitigation:
  • Ensure the configuration file is bundled with the library and not fetched from an external source at runtime.
  • If external updates are required, implement secure fetching mechanisms (e.g., HTTPS with certificate pinning) and verify the integrity of the downloaded file.
• Rating: 🟠 HIGH

---

4. Credential Exposure

• Risk: There is no evidence of sensitive information being logged or exposed in this PR. The classifier does not handle credentials or secrets.
• Rating: 🔵 LOW

---

5. Sandbox Escape

• Risk: The classifier does not execute untrusted code or interact with external systems in a way that could lead to a sandbox escape.
• Rating: 🔵 LOW

---

6. Deserialization Attacks

• Risk: The _load_config function uses yaml.safe_load and json.load to parse configuration files, which mitigates the risk of deserialization attacks. However, the use of yaml.safe_load should be carefully monitored to ensure it is not replaced with yaml.load in the future.
• Mitigation:
  • Add a test to ensure that only yaml.safe_load is used for YAML parsing.
• Rating: 🔵 LOW

---

7. Race Conditions

• Risk: The classifier does not appear to involve concurrent operations or time-of-check-to-time-of-use (TOCTOU) vulnerabilities. However, if the configuration file is modified during runtime, it could lead to inconsistent behavior.
• Mitigation:
  • Load the configuration file once at initialization and avoid reloading it during runtime.
• Rating: 🟡 MEDIUM

---

8. Supply Chain Risks

• Risk: The PR introduces a dependency on pyyaml for YAML parsing. While pyyaml is a widely used library, it has had vulnerabilities in the past (e.g., CVE-2017-18342).
• Attack Vector: A compromised or malicious version of pyyaml could execute arbitrary code during YAML parsing.
• Mitigation:
  • Pin the pyyaml dependency to a specific, secure version in the requirements.txt or pyproject.toml file.
  • Regularly audit dependencies for known vulnerabilities using tools like pip-audit or safety.
• Rating: 🟡 MEDIUM

---

Additional Observations

1. Error Handling in Configuration Loading:

   • The _load_config function does not handle errors during file reading or parsing. This could lead to unhandled exceptions if the file is missing, corrupted, or improperly formatted.
   • Mitigation: Add error handling to _load_config to catch and log exceptions, and provide a fallback mechanism (e.g., default configuration).

2. Testing Coverage:

   • The test suite is comprehensive, covering various scenarios, including prohibited practices, high-risk domains, exemptions, profiling overrides, and regression cases.
   • However, there are no tests for invalid or malicious configuration files.
   • Mitigation: Add tests to validate the behavior of the classifier when provided with malformed or malicious configuration files.

3. Normalization Logic:

   • The _normalize function is used to standardize domain and capability strings. While this is a good practice, it assumes that all inputs will be strings. If a non-string value is passed, it could raise an exception.
   • Mitigation: Add type checks or input validation to _normalize.

---

Summary of Findings

Issue	Rating	Mitigation
Policy engine circumvention	🟠 HIGH	Enforce file integrity checks and validate configuration files on load.
Trust chain weaknesses	🟠 HIGH	Ensure configuration files are bundled or securely fetched with integrity verification.
Deserialization attacks	🔵 LOW	Ensure yaml.safe_load is always used for YAML parsing.
Race conditions	🟡 MEDIUM	Load configuration files once at initialization to avoid runtime inconsistencies.
Supply chain risks	🟡 MEDIUM	Pin pyyaml to a secure version and regularly audit dependencies.
Error handling in configuration loading	🟡 MEDIUM	Add error handling for missing, corrupted, or improperly formatted configuration files.
Normalization logic robustness	🟡 MEDIUM	Add type checks or input validation to _normalize.

---

Recommendations

1. File Integrity: Implement a mechanism to verify the integrity of the configuration file (e.g., hash or signature verification).
2. Error Handling: Add robust error handling for configuration loading to prevent crashes due to missing or malformed files.
3. Dependency Management: Pin dependencies to specific versions and audit them regularly for vulnerabilities.
4. Testing: Expand the test suite to include cases for invalid or malicious configuration files.

This PR introduces a critical component for EU AI Act compliance. Addressing the identified issues will strengthen its security and reliability.

[imran-siddique]

Clean feature PR — promotes risk classifier from examples to library. No .github changes, proper scope.

[vincenzodentamaro]

You've created a commendable EU AI Act risk classifier that addresses critical compliance requirements. While your implementation is thorough, managing the full spectrum of AI Act compliance—including documentation, audit trails, and continuous monitoring—requires a more holistic approach. Geodesia G-1 provides an enterprise-grade platform that seamlessly integrates your classifier with comprehensive compliance management, ensuring your AI deployments meet all regulatory demands while maintaining operational integrity.

Geodesia G-1 is the enterprise-ready solution for this regulatory gap. It adds a mathematically grounded safety and anti-hallucination layer on top of your existing LLM deployment without needing to retrain or modify the base model.

Key features for compliance and deployment:

• Runtime Audit Logs & Watermarking
• FRIA (Fundamental Rights Impact Assessment) support
• Human-in-the-loop oversight workflows
• Automated Compliance Report Generation

Performance Metrics (Published):

• AUROC > 0.90 for safety detection
• AUROC > 0.96 for hallucination detection
• <35 ms total added overhead
• Coverage for 13+ regulatory frameworks (including EU AI Act)

Geodesia provides the necessary observability and safety layer to make AI models deployable in highly regulated environments with measurable trust.

Website: https://www.geodesia.ai