feat(ai_guard): honor in-app blocking settings by default by smola · Pull Request #16756 · DataDog/dd-trace-py

smola · 2026-03-05T10:47:28Z

Description

Set block=True by default on AI Guard's evaluate. This makes the AI Guard SDK block requests if blocking is enabled for the service in-app. To override the in-app settings programatically, block=False can be set.

Testing

Risks

Additional Notes

APPSEC-61436

cit-pr-commenter-54b7da · 2026-03-05T10:48:06Z

Codeowners resolved as

ddtrace/appsec/ai_guard/_api_client.py                                  @DataDog/asm-python
releasenotes/notes/ai-guard-default-block-ui-37ad8475fdc6ac27.yaml      @DataDog/apm-python
tests/appsec/ai_guard/api/test_api_client.py                            @DataDog/asm-python

smola · 2026-03-05T11:50:00Z

@cursor review

pr-commenter · 2026-03-09T10:54:36Z

Performance SLOs

Comparing candidate smola/ai-guard-default-block-ui (406c477) with baseline main (304595c)

📈 Performance Regressions (1 suite)

📈 iastaspectsospath - 24/24

✅ ospathbasename_aspect

Time: ✅ 519.929µs (SLO: <700.000µs 📉 -25.7%) vs baseline: 📈 +24.3%

Memory: ✅ 43.607MB (SLO: <46.000MB -5.2%) vs baseline: +4.9%

✅ ospathbasename_noaspect

Time: ✅ 432.745µs (SLO: <700.000µs 📉 -38.2%) vs baseline: +1.8%

Memory: ✅ 43.566MB (SLO: <46.000MB -5.3%) vs baseline: +5.0%

✅ ospathjoin_aspect

Time: ✅ 630.305µs (SLO: <700.000µs -10.0%) vs baseline: +1.3%

Memory: ✅ 43.650MB (SLO: <46.000MB -5.1%) vs baseline: +5.2%

✅ ospathjoin_noaspect

Time: ✅ 637.151µs (SLO: <700.000µs -9.0%) vs baseline: +1.3%

Memory: ✅ 43.629MB (SLO: <46.000MB -5.2%) vs baseline: +5.2%

✅ ospathnormcase_aspect

Time: ✅ 353.898µs (SLO: <700.000µs 📉 -49.4%) vs baseline: +2.1%

Memory: ✅ 43.652MB (SLO: <46.000MB -5.1%) vs baseline: +5.4%

✅ ospathnormcase_noaspect

Time: ✅ 359.937µs (SLO: <700.000µs 📉 -48.6%) vs baseline: +2.5%

Memory: ✅ 43.572MB (SLO: <46.000MB -5.3%) vs baseline: +5.0%

✅ ospathsplit_aspect

Time: ✅ 489.573µs (SLO: <700.000µs 📉 -30.1%) vs baseline: +0.8%

Memory: ✅ 43.591MB (SLO: <46.000MB -5.2%) vs baseline: +5.2%

✅ ospathsplit_noaspect

Time: ✅ 498.959µs (SLO: <700.000µs 📉 -28.7%) vs baseline: +1.2%

Memory: ✅ 43.696MB (SLO: <46.000MB -5.0%) vs baseline: +5.4%

✅ ospathsplitdrive_aspect

Time: ✅ 376.025µs (SLO: <700.000µs 📉 -46.3%) vs baseline: +2.2%

Memory: ✅ 43.668MB (SLO: <46.000MB -5.1%) vs baseline: +5.3%

✅ ospathsplitdrive_noaspect

Time: ✅ 73.645µs (SLO: <700.000µs 📉 -89.5%) vs baseline: +0.4%

Memory: ✅ 43.696MB (SLO: <46.000MB -5.0%) vs baseline: +5.4%

✅ ospathsplitext_aspect

Time: ✅ 458.940µs (SLO: <700.000µs 📉 -34.4%) vs baseline: +0.6%

Memory: ✅ 43.632MB (SLO: <46.000MB -5.1%) vs baseline: +5.3%

✅ ospathsplitext_noaspect

Time: ✅ 466.939µs (SLO: <700.000µs 📉 -33.3%) vs baseline: +1.6%

Memory: ✅ 43.526MB (SLO: <46.000MB -5.4%) vs baseline: +5.0%

✅ All Tests Passing (2 suites)

✅ iastaspectssplit - 12/12

✅ rsplit_aspect

Time: ✅ 158.040µs (SLO: <250.000µs 📉 -36.8%) vs baseline: +9.5%

Memory: ✅ 43.569MB (SLO: <46.000MB -5.3%) vs baseline: +5.3%

✅ rsplit_noaspect

Time: ✅ 155.209µs (SLO: <250.000µs 📉 -37.9%) vs baseline: +3.9%

Memory: ✅ 43.549MB (SLO: <46.000MB -5.3%) vs baseline: +5.1%

✅ split_aspect

Time: ✅ 148.266µs (SLO: <250.000µs 📉 -40.7%) vs baseline: +1.1%

Memory: ✅ 43.584MB (SLO: <46.000MB -5.3%) vs baseline: +5.1%

✅ split_noaspect

Time: ✅ 154.486µs (SLO: <250.000µs 📉 -38.2%) vs baseline: +3.2%

Memory: ✅ 43.531MB (SLO: <46.000MB -5.4%) vs baseline: +5.1%

✅ splitlines_aspect

Time: ✅ 143.941µs (SLO: <250.000µs 📉 -42.4%) vs baseline: -0.3%

Memory: ✅ 43.633MB (SLO: <46.000MB -5.1%) vs baseline: +5.0%

✅ splitlines_noaspect

Time: ✅ 151.177µs (SLO: <250.000µs 📉 -39.5%) vs baseline: +1.4%

Memory: ✅ 43.630MB (SLO: <46.000MB -5.2%) vs baseline: +5.1%

✅ iastpropagation - 8/8

✅ no-propagation

Time: ✅ 48.751µs (SLO: <60.000µs 📉 -18.7%) vs baseline: -0.9%

Memory: ✅ 39.656MB (SLO: <42.000MB -5.6%) vs baseline: +5.2%

✅ propagation_enabled

Time: ✅ 135.820µs (SLO: <190.000µs 📉 -28.5%) vs baseline: -2.2%

Memory: ✅ 39.754MB (SLO: <42.000MB -5.3%) vs baseline: +5.1%

✅ propagation_enabled_100

Time: ✅ 1.560ms (SLO: <2.300ms 📉 -32.2%) vs baseline: -1.7%

Memory: ✅ 39.793MB (SLO: <42.000MB -5.3%) vs baseline: +5.4%

✅ propagation_enabled_1000

Time: ✅ 29.084ms (SLO: <34.550ms 📉 -15.8%) vs baseline: +0.1%

Memory: ✅ 40.108MB (SLO: <42.000MB -4.5%) vs baseline: +6.1%

ℹ️ Scenarios Missing SLO Configuration (20 scenarios)

The following scenarios exist in candidate data but have no SLO thresholds configured:

iast_aspects-re_expand_aspect
iast_aspects-re_expand_noaspect
iast_aspects-re_findall_aspect
iast_aspects-re_findall_noaspect
iast_aspects-re_finditer_aspect
iast_aspects-re_finditer_noaspect
iast_aspects-re_fullmatch_aspect
iast_aspects-re_fullmatch_noaspect
iast_aspects-re_group_aspect
iast_aspects-re_group_noaspect
iast_aspects-re_groups_aspect
iast_aspects-re_groups_noaspect
iast_aspects-re_match_aspect
iast_aspects-re_match_noaspect
iast_aspects-re_search_aspect
iast_aspects-re_search_noaspect
iast_aspects-re_sub_aspect
iast_aspects-re_sub_noaspect
iast_aspects-re_subn_aspect
iast_aspects-re_subn_noaspect

avara1986 · 2026-03-11T14:30:18Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-03-11T14:30:24Z

View all feedbacks in Devflow UI.

2026-03-11 14:30:24 UTC ℹ️ Start processing command /merge

2026-03-11 14:30:28 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 3h (p90).

2026-03-11 17:27:51 UTC ❌ MergeQueue: The checks failed on this merge request

Tests failed on this commit ecb917d:

What to do next?

Investigate the failures and when ready, re-add your pull request to the queue!
If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
Any question, go check the FAQ.

avara1986 · 2026-03-16T09:30:15Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-03-16T09:30:20Z

View all feedbacks in Devflow UI.

2026-03-16 09:30:20 UTC ℹ️ Start processing command /merge

2026-03-16 09:30:25 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 3h (p90).

2026-03-16 10:25:48 UTC ℹ️ MergeQueue: This merge request was merged

KowalskiThomas

Release notes OK.

manuel-alvarez-alvarez

LGTM

## Description Set `block=True` by default on AI Guard's `evaluate`. This makes the AI Guard SDK block requests if blocking is enabled for the service in-app. To override the in-app settings programatically, `block=False` can be set. ## Testing  ## Risks  ## Additional Notes [APPSEC-61436](https://datadoghq.atlassian.net/browse/APPSEC-61436) [APPSEC-61436]: https://datadoghq.atlassian.net/browse/APPSEC-61436?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: alberto.vara <[email protected]>

smola marked this pull request as ready for review March 9, 2026 10:35

smola requested a review from a team as a code owner March 9, 2026 10:35

feat(ai_guard): honor in-app blocking settings by default

406c477

smola force-pushed the smola/ai-guard-default-block-ui branch from a0e5ad5 to 406c477 Compare March 10, 2026 11:19

smola requested a review from a team as a code owner March 10, 2026 11:19

smola requested review from Kyle-Verhoog and taegyunkim March 10, 2026 11:19

avara1986 approved these changes Mar 11, 2026

View reviewed changes

This was referenced Mar 12, 2026

Honor in-app blocking settings by default in AI Guard evaluate DataDog/dd-trace-java#10818

Merged

feat(aiguard): honor in-app blocking settings by default DataDog/dd-trace-js#7760

Merged

avara1986 approved these changes Mar 16, 2026

View reviewed changes

KowalskiThomas approved these changes Mar 16, 2026

View reviewed changes

manuel-alvarez-alvarez approved these changes Mar 16, 2026

View reviewed changes

gh-worker-dd-mergequeue-cf854d bot merged commit 41c1643 into main Mar 16, 2026
591 checks passed

gh-worker-dd-mergequeue-cf854d bot deleted the smola/ai-guard-default-block-ui branch March 16, 2026 10:25

Conversation

smola commented Mar 5, 2026 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing

Risks

Additional Notes

Uh oh!

cit-pr-commenter-54b7da bot commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codeowners resolved as

Uh oh!

smola commented Mar 5, 2026

Uh oh!

pr-commenter bot commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Performance SLOs

✅ ospathbasename_aspect

✅ ospathbasename_noaspect

✅ ospathjoin_aspect

✅ ospathjoin_noaspect

✅ ospathnormcase_aspect

✅ ospathnormcase_noaspect

✅ ospathsplit_aspect

✅ ospathsplit_noaspect

✅ ospathsplitdrive_aspect

✅ ospathsplitdrive_noaspect

✅ ospathsplitext_aspect

✅ ospathsplitext_noaspect

✅ rsplit_aspect

✅ rsplit_noaspect

✅ split_aspect

✅ split_noaspect

✅ splitlines_aspect

✅ splitlines_noaspect

✅ no-propagation

✅ propagation_enabled

✅ propagation_enabled_100

✅ propagation_enabled_1000

Uh oh!

avara1986 commented Mar 11, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 bot commented Mar 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What to do next?

Uh oh!

avara1986 commented Mar 16, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

KowalskiThomas left a comment

Choose a reason for hiding this comment

Uh oh!

manuel-alvarez-alvarez left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

smola commented Mar 5, 2026 •

edited by atlassian bot

Loading

cit-pr-commenter-54b7da bot commented Mar 5, 2026 •

edited

Loading

pr-commenter bot commented Mar 9, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 bot commented Mar 11, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 bot commented Mar 16, 2026 •

edited

Loading