Azure AI Agent Service Middleware

npm install @tealtiger/azure-ai-agent-middleware

import { TealTigerAzureMiddleware } from '@tealtiger/azure-ai-agent-middleware';
import { TealEngine } from 'tealtiger';

const engine = new TealEngine({
  policy: {
    rules: [
      { condition: { tool: 'sql_query', params: { query: { contains: 'DROP' } } }, automation: 'auto_deny' },
      { condition: { tool: 'file_write', path: { pattern: '/system/**' } }, automation: 'auto_deny' },
      { condition: { tool: 'email_send', recipients: { gt: 10 } }, automation: 'approval_required' }
    ]
  },
  freeze: [
    { id: 'FREEZE-001', condition: { tool: 'admin_*' }, reason: 'FREEZE_ADMIN_TOOLS', severity: 'critical' }
  ],
  modules: [new TealClassifier(), new TealDrift(), new TealMonitor()]
});

const middleware = new TealTigerAzureMiddleware({
  engine,
  deployment: 'azure-function',
  identity: {
    // Use Azure Managed Identity for workload identity binding
    method: 'managed-identity',
    clientId: process.env.AZURE_CLIENT_ID
  },
  evidence: {
    storage: 'azure-blob',
    container: 'tealtiger-evidence',
    connectionString: process.env.AZURE_STORAGE_CONNECTION
  }
});

// Register as tool-call interceptor
export default middleware.createHandler();

const middleware = new TealTigerAzureMiddleware({
  engine,
  deployment: 'sidecar',
  port: 8090,
  healthEndpoint: '/healthz',
  identity: {
    method: 'workload-identity',
    tenantId: process.env.AZURE_TENANT_ID,
    clientId: process.env.AZURE_CLIENT_ID
  }
});

await middleware.start();
// Middleware listens on localhost:8090/evaluate
// Azure AI Agent Service routes tool calls through middleware

interface AzureMiddlewareOptions {
  /** TealEngine instance */
  engine: TealEngine;

  /** Deployment mode */
  deployment: 'azure-function' | 'sidecar' | 'container-app';

  /** Azure identity configuration */
  identity: {
    method: 'managed-identity' | 'workload-identity' | 'service-principal';
    clientId?: string;
    tenantId?: string;
  };

  /** Evidence storage */
  evidence: {
    storage: 'azure-blob' | 'cosmos-db';
    container?: string;
    connectionString?: string;
    /** Use customer-managed keys for encryption */
    cmk?: { keyVaultUrl: string; keyName: string };
  };

  /** Tool-call mapping */
  toolMapping?: Record<string, string>;

  /** Application Insights integration */
  appInsights?: {
    enabled: boolean;
    connectionString: string;
    /** Custom dimensions for governance events */
    customDimensions?: Record<string, string>;
  };

  /** Cost tracking with Azure Cost Management */
  costTracking?: {
    enabled: boolean;
    /** Tag governance costs in Azure Cost Management */
    costTags: Record<string, string>;
  };
}

// Tool call flow with middleware:
// 1. Agent selects tool (e.g., "sql_query")
// 2. Azure AI Agent Service prepares tool call
// 3. TealTiger middleware intercepts:
//    a. Extracts tool name and parameters
//    b. Maps to governance action
//    c. Evaluates against policy
//    d. Returns ALLOW/DENY
// 4. If ALLOW: tool executes normally
// 5. If DENY: error response returned to agent

middleware.onToolCall(async (toolCall) => {
  const decision = await engine.evaluate(
    {
      action: `tool.${toolCall.name}`,
      tool: toolCall.name,
      toolParams: toolCall.parameters,
      content: JSON.stringify(toolCall.parameters)
    },
    {
      correlation_id: toolCall.correlationId,
      agentId: toolCall.agentId,
      sessionId: toolCall.sessionId
    }
  );

  return decision;
});

// Custom events emitted:
// TealTiger.Evaluation — every governance evaluation
// TealTiger.Denial — denied tool calls
// TealTiger.DriftDetected — behavioral drift alerts
// TealTiger.CostAnomaly — cost anomaly detection
// TealTiger.FreezeViolation — FREEZE rule triggers

// Custom metrics:
// TealTiger.EvaluationLatencyMs
// TealTiger.DriftScore
// TealTiger.CostUSD
// TealTiger.DenialRate

const middleware = new TealTigerAzureMiddleware({
  engine,
  secrets: {
    keyVault: 'https://tealtiger-kv.vault.azure.net/',
    // Policy signing key, TSA credentials, etc.
    references: {
      policySigningKey: 'tealtiger-policy-signing-key',
      tsaCredential: 'tealtiger-tsa-credential'
    }
  }
});

const middleware = new TealTigerAzureMiddleware({
  engine,
  eventGrid: {
    enabled: true,
    topicEndpoint: 'https://tealtiger-events.eastus-1.eventgrid.azure.net/api/events',
    events: ['denial', 'drift', 'freeze_violation', 'cost_anomaly']
  }
});