.NET: [Bug]: AsAIAgent workflows duplicate sensitive content in generic telemetry tags #9855

Observed Behavior

A .NET workflow configured with EnableSensitiveData = true emits raw payloads on generic workflow span attributes such as executor.input, executor.output, and message.content. When that workflow is wrapped with AsAIAgent(), agent/model/tool instrumentation can also emit the same content under canonical GenAI attributes.

The hosted-agent path therefore duplicates sensitive content across two attribute families that may be exported, governed, or redacted differently. Direct workflow execution still needs the existing opt-in payload capture behavior for diagnostics and evaluations.

Expected Behavior

When a workflow executes through AsAIAgent(), generic workflow payload attributes should be suppressed by default while metadata and canonical agent/model/tool telemetry remain available. Direct workflows should preserve the current EnableSensitiveData behavior. An explicit hosted-workflow compatibility option should preserve the legacy generic payload copies for applications that intentionally need and protect them.

The outermost workflow passed to AsAIAgent() should own this policy for the whole hosted execution, including streaming runs, Lockstep execution across multiple supersteps, nested workflows, and nested hosted workflow agents. Inner workflows must not reopen an outer suppression boundary. When compatibility is enabled at the outer boundary, each workflow's own EnableSensitiveData setting should continue to determine whether that workflow emits payload tags.

Steps to Reproduce

1. Build an agent-backed workflow with OpenTelemetry enabled and EnableSensitiveData = true.
2. Wrap the workflow with AsAIAgent().
3. Run the hosted agent with a message containing a unique value.
4. Inspect emitted workflow activities.
5. Observe the value on generic executor.input, executor.output, or message.content tags in addition to canonical GenAI telemetry.

Minimal Reproduction

AIAgent agent = chatClient.AsAIAgent(name: "echo-agent");
ExecutorBinding executor = agent.BindAsExecutor(
    new AIAgentHostOptions { EmitAgentResponseEvents = true });

Workflow workflow = new WorkflowBuilder(executor)
    .WithOutputFrom(executor)
    .WithOpenTelemetry(configure: options => options.EnableSensitiveData = true)
    .Build();

AIAgent hostedWorkflow = workflow.AsAIAgent(
    includeWorkflowOutputsInResponse: true);

await hostedWorkflow.RunAsync(
    new ChatMessage(ChatRole.User, "unique-sensitive-value"));

Attach an ActivityListener for Microsoft.Agents.AI.Workflows and inspect the resulting workflow activity tags.

Package Versions

Microsoft Agent Framework .NET built from main at 4d28d0a4ba77b1a9906ba422a3737eaff3de814f.

.NET Version

.NET SDK 10.0.403

Operating System

Windows

Regression

Unknown. This concerns the interaction between hosted workflows and the workflow payload capture introduced in #3467.

Additional Context

• Related to the broader workflow telemetry discussion in .NET: Workflow Middleware to Support Customizing Telemetry #3075, but this issue is specifically about safe defaults when the workflow is hosted as an agent.
• Proposed direction: preserve direct-workflow behavior, suppress generic payload copies for hosted execution by default, and add an explicit compatibility opt-in at the outermost hosted workflow boundary.
• This is an intentional behavior-breaking default change. Existing hosted applications that relied on generic payload tags must set IncludeSensitiveDataWhenHostedAsAgent = true on the outermost workflow passed to AsAIAgent().
• This issue captures a design discussed with the .NET workflow owners; the linked implementation will remain a draft pending GitHub maintainer agreement.
• AI assistance: Copilot assisted with implementation analysis, tests, documentation, multi-model review, and issue wording. I reviewed and verified the reproduction and technical claims.

Acknowledgements

• I searched existing issues and did not find a duplicate.
• I personally verified this behavior and the reproduction details are authentic.
• I will wait for explicit GitHub maintainer agreement before marking the implementation ready for review.