Skip to content

AIFunctionFactory Tools does not go through permission handler | Dotnet | NodeJS #254

Closed

Description

@ShrayRastogi

Issue: Tools defined through AIFunctionFactory does not follow approval or permission workflow and are invoked automatically. There should be an option to specify permissionRequired within the tool definition and they should seek permission from user before invoking the tool if not specified otherwise.

// Define a tool that Copilot can call
var getWeather = AIFunctionFactory.Create(
    ([Description("The city name")] string city) =>
    {
        // In a real app, you'd call a weather API here
        var conditions = new[] { "sunny", "cloudy", "rainy", "partly cloudy" };
        var temp = Random.Shared.Next(50, 80);
        var condition = conditions[Random.Shared.Next(conditions.Length)];
        return new { city, temperature = $"{temp}°F", condition };
    },
    "get_weather",
    "Get the current weather for a city"
);

await using var client = new CopilotClient(new CopilotClientOptions { LogLevel = "all" });
await using var session = await client.CreateSessionAsync(new SessionConfig
{
    Model = "gpt-5.2",
    Streaming = true,
    Tools = [getWeather],
    OnPermissionRequest = async (permissionRequest, permissionInvocation) =>
    {
        Console.WriteLine($"\n⚠️ Permission Requested: {permissionRequest.Kind}");
        Console.WriteLine($"   Details: {System.Text.Json.JsonSerializer.Serialize(permissionRequest.ExtensionData)}");

        // For custom tools, ask the user
        Console.Write("Allow? (Y/N): ");
        var response = Console.ReadLine();
        if (string.Equals(response, "Y", StringComparison.OrdinalIgnoreCase))
        {
            return await Task.FromResult(new PermissionRequestResult { Kind = "approved" });
        }
        else
        {
            return await Task.FromResult(new PermissionRequestResult { Kind = "denied-interactively-by-user" });
        }
    }
});

Expected Behaviur: All tool invocations by the assistant, regardless of their implementation, must follow permission workflow and go through permission handler unless stated otherwise. AIFunctionFactory should also expose a property to set whether permission required or not. For example, approvalMode set to AutoApproved or NeverRequire or Always etc.

Output:

You: Whats the weather in Sambhal
Assistant: I’m fetching the current weather for Sambhal. Sambhal weather right now: **58°F (cloudy)**.

SDK tested: NodeJS and Dotnet with version 0.1.19

Activity

  1. github-actions commented on Jan 29, 2026

    @github-actions
    Contributor

    Thank you for reporting this issue, @ShrayRastogi!

    I've labeled this as:

    • bug — Tools bypassing the permission handler is unintended behavior
    • sdk/dotnet & sdk/nodejs — Affects both SDKs (version 0.1.19)
    • security — Permission controls should not be bypassed

    The issue is well-documented with reproduction steps, expected behavior, and actual output. The team will review this security concern regarding AIFunctionFactory tools not respecting the OnPermissionRequest handler.

    AI generated by Issue Triage Agent

  2. ShrayRastogi commented on Feb 8, 2026

    @ShrayRastogi
    Author

    @copilot - any updates here?

  3. SteveSandersonMS commented on Feb 24, 2026

    @SteveSandersonMS
    Contributor

    Thanks for reporting this, @ShrayRastogi. It will be addressed by #555

  4. added this to the Public Preview milestone on Feb 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

No type

Projects

No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions