feat(agents): integrate Entra identity registration and authorization by joshua-berri · Pull Request #43149 · BerriAI/litellm

joshua-berri · 2026-09-25T07:05:08Z

TLDR

Problem this solves:

Entra agent identity and authorization needs an integrated gateway workflow

How it solves it:

Registers explicit Entra bindings in existing agent forms
Supports autonomous and verified delegated agent execution
Intersects model, agent, MCP server and tool permissions
Records agent identity and originating user separately

Base of the four-PR stack; followed by #43229, #43230 and #43459. Reconciles existing implementation and review fixes; no additional feature scope

Diff sizes are being refreshed after the reviewed repairs

User Flow

Before: the complete workflow below is unavailable at this PR's parent

Open Agents and add or edit an agent
Select Microsoft Entra ID, enter its application identity, and save
Obtain an Entra token for the gateway and call an allowed model/tool
Observe denied calls for missing grants or disabled identities
Inspect identity status and request attribution

After: this PR provides the workflow through the existing gateway surfaces

Open Agents and add or edit an agent
Select Microsoft Entra ID, enter its application identity, and save
Obtain an Entra token for the gateway and call an allowed model/tool
Observe denied calls for missing grants or disabled identities
Inspect identity status and request attribution

Relevant issues

Original complete implementation: #43149

Affected release

Linear ticket

Pre-Submission checklist

Existing implementation and review fixes are preserved
Meaningful tests remain with their owning behavior
Devin verification at the reconciled head is complete
Required CI and completed Codecov pass
Greptile, Veria and Bugbot reviews have no actionable findings
User has accepted the hosted UI workflow

Screenshots / Proof of Fix

The existing Entra application, agent-user, delegated user, MCP authorization and attribution flows were exercised on the combined stack in Devin. Latest repairs add actor-and-target rate accounting; two focused cases pass, including settlement to actual usage. Applying the same regression to the earlier implementation exposes the missing target charge and actor reconciliation

The current repair removes a loop-local Final declaration rejected by basedpyright without changing the policy expression. Two rate regressions pass and the specific type diagnostic is gone. The restored selector UI passes 611 tests with two expected failures, unchanged type diagnostics and fewer lint warnings than the baseline. The production build and final hosted CI remain pending

Previous-tip Greptile scored 5/5. Veria's agent budget and delegated-team concerns are implemented in dependent #43229 and #43459; this prerequisite alone is not the complete feature

Type

New Feature

Caveats

Part of the four-PR identity, budgets, SCIM and delegated-team stack; do not release the complete feature without fix(agents): preserve delegated team authorization context #43459
Current-tip verification and reviews remain pending; fresh Bugbot review is waived due to team quota
Optional selector cleanup is excluded and saved as an unpublished follow-up

Final Attestation

Current-tip CI, coverage and review gates are complete

codspeed · 2026-09-25T07:13:34Z

Merging this PR will not alter performance

✅ 31 untouched benchmarks

_{Comparing litellm_agent_entra_identity (080de40) with main (22b36cb)¹}

No successful run was found on main (268e8bb) during the generation of this report, so 22b36cb was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

codecov · 2026-09-25T07:15:30Z

Codecov Report

❌ Patch coverage is 99.17441% with 8 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...erimental/mcp_server/auth/user_api_key_auth_mcp.py	96.29%	2 Missing ⚠️
litellm/proxy/auth/handle_jwt.py	94.59%	2 Missing ⚠️
...perimental/mcp_server/auth/managed_agent_access.py	97.95%	1 Missing ⚠️
...m/proxy/_experimental/mcp_server/rest_endpoints.py	93.75%	1 Missing ⚠️
...tellm/proxy/_experimental/mcp_server/toolset_db.py	80.00%	1 Missing ⚠️
litellm/proxy/auth/user_api_key_auth.py	93.33%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

joshua-berri · 2026-09-25T15:36:51Z

@greptileai @veria-ai @cursor review Please review bbf7e15 for Entra identity isolation, SCIM lifecycle, permission intersections, budgets, and compatibility after CI repairs

joshua-berri · 2026-09-25T15:44:41Z

@cursor review

Please review bbf7e15 for identity isolation, SCIM revocation, delegated permissions, and compatibility following the CI repairs

greptile-apps · 2026-09-25T15:46:04Z

Confidence Score: 5/5

[Critical risk] Adds identity and authorization system for managed agents with database schema changes.

No outstanding finding or new issue from the latest change prevents merging this PR on its own.

Summary

The PR adds Entra-managed agent identity and authorization across gateway requests, MCP access, persistence, attribution, and the dashboard. Since the previous review, the rate-limit policy expression received a type-only adjustment; no new actionable issue was identified.

_{Reviews (27) · Last reviewed commit: "fix(agents): pass rate policy without lo..."}

cursor

Stale Bugbot comment from a previous run.

joshua-berri · 2026-09-25T16:06:26Z

@greptileai @veria-ai Please review c5d3ad3: three confirmed findings repaired, regressions passing, and the cardinality finding withdrawn after checking Microsoft documentation

joshua-berri · 2026-09-25T16:06:28Z

@cursor review
Please verify c5d3ad3 closes the managed identity bypass and check the new authorization compatibility regressions

cursor

Stale Bugbot comment from a previous run.

veria-ai · 2026-09-25T16:19:19Z

PR overview

This pull request integrates Microsoft Entra identity registration and authorization for agents, including delegated team permissions and JWT-based agent authentication.

Six issues have been addressed, but two authorization and budget-enforcement gaps remain. A multi-team user may bypass the granting team’s model and budget restrictions, while holders of keyless agent credentials can generate paid inference without a spend ceiling. These issues should be resolved before production use of autonomous agent identities.

Open issues (2)

Medium: Preserve the team that grants delegated access — litellm/proxy/agent_endpoints/auth/agent_permission_handler.py:658
Medium: Keyless agents bypass spend limits — litellm/proxy/auth/handle_jwt.py:2515

Fixed/addressed: 6 · PR risk: 7/10

joshua-berri · 2026-09-25T16:19:54Z

@greptileai @veria-ai Please review f254d22, including current main, repaired database-free JWT authentication, and fail-closed invocation for binding-only config targets

joshua-berri · 2026-09-25T16:19:56Z

@cursor review
Please verify f254d22 closes the binding-only invocation bypass and preserves database-free authentication for ordinary and unmanaged-agent JWTs

cursor

Stale Bugbot comment from a previous run.

joshua-berri · 2026-09-25T16:36:42Z

@greptileai Please review 00429f6: managed identities now use explicit inference, MCP, A2A and discovery routes; provider-resource endpoints are denied

joshua-berri · 2026-09-25T16:36:44Z

@veria-ai Please verify 00429f6 closes provider-resource access for managed Entra tokens and persisted agent keys; regression tests cover both paths

joshua-berri · 2026-09-25T16:36:45Z

@cursor review
Please review 00429f6, including explicit managed-agent route authorization and regression tests covering provider-resource denial and legitimate inference access

cursor

Stale Bugbot comment from a previous run.

joshua-berri · 2026-09-25T16:55:28Z

@greptileai Please review 28e187f: configured model defaults now undergo managed-agent authorization and budget reservation. Previously withdrawn findings remain documented limitations.

joshua-berri · 2026-09-25T16:55:30Z

@veria-ai Please verify 28e187f closes the configured-default model bypass. Four live requests reproduced it; 35 additional authorization and reservation regressions pass.

joshua-berri · 2026-09-25T16:55:31Z

@cursor review
Please review 28e187f: managed inference resolves configured model defaults before grants and budget reservation, preserving non-managed request handling.

veria-ai · 2026-09-27T20:12:43Z

+    human: Final = await MCPRequestHandler.reload_admitted_user(user_id, requires_fresh_policy=True)
+    sources: Final = await MCPRequestHandler.admitted_subject_sources(human)
+    human_access: Final = await asyncio.gather(*(_strict_agent_access(source) for source in sources))
+    return frozenset().union(*(_granted_ids(access) for access in human_access))


Medium: Preserve the team that grants delegated access

This union discards which team authorized the agent. A multi-team user with an unrestricted direct model list can use a grant from a model-restricted team to invoke any model allowed by the agent, because JWT authorization does not attach a team for multi-team users and therefore skips that team's model and budget enforcement. Return source-aware grants and carry a qualifying team into the request authorization context.

Implemented and live-verified in dependent #43459; budgets ship in #43229. Please assess this prerequisite with its documented stack dependencies, not standalone rollout.

joshua-berri · 2026-09-27T20:46:08Z

@greptileai @veria-ai Please review current tip 1b0162b. The stack now has four PRs; delegated-team authorization is isolated in #43459. Focused remote verification runs alongside CI. Please check prior findings and current diff

joshua-berri · 2026-09-27T21:03:34Z

@greptileai @veria-ai Please review the current tip. The optional team-selector cleanup is absent from all four merge-base diffs; those six UI files match the original main merge-base, so incomplete group discovery is pre-existing and deferred. Identity now retains authoritative target rate policy; budgets bind explicit A2A billing to the path; PR4 preserves grant-team authority and consumes JWT verification once. Focused tests/live checks run in parallel with CI

joshua-berri · 2026-09-27T21:16:58Z

@greptileai @veria-ai Please review the current tip and confirm resolution of the focused findings. Actor/target token settlement now reuses recorded reservation scopes; delegated tests use module-boundary isolation. No unrelated features or selector cleanup were added. Fresh verification runs in parallel with CI

joshua-berri · 2026-09-27T21:28:24Z

@greptileai @veria-ai Current tip 485bc29 applies the exact Ruff formatting correction only; behavioral patches are unchanged. Focused delegated tests168pass, rate settlement2pass, and actual Entra before/after confirm grant-team model, route and budget denial. Please confirm current-tip review outcomes; remaining live controls and CI are pending

veria-ai · 2026-09-27T21:36:04Z

+            if isinstance(evidence, AgentIdentityFailure):
+                raise_identity_failure(evidence)
+            if managed.mode == "autonomous":
+                return JWTAuthBuilderResult(


Medium: Keyless agents bypass spend limits

This principal has no key, user, team, organization, or end-user budget, and agents expose spend tracking but no maximum budget. Consequently, _get_budget_counters() returns no counters and reserve_budget_for_request() exits before enforcing the new fail-closed setting, allowing anyone holding this agent credential to generate paid inference without a spend ceiling. Require a budget-bearing principal for autonomous identities or add an agent maximum-budget counter to reservation and enforcement.

Agent spend enforcement is implemented in dependent #43229; granting-team enforcement is in #43459. These four stacked PRs ship together, not independently.

joshua-berri · 2026-09-27T21:54:08Z

@greptileai @veria-ai Please review 080de40: type-only rate fix verified. Agent budgets and delegated authorization remain in dependent #43229 and #43459.

joshua-berri · 2026-09-28T15:59:57Z

@veria-ai Please refresh review: both remaining findings have verified fixes in dependent #43229 and #43459; this prerequisite is not standalone rollout.

joshua-berri had a problem deploying to e2e-changed September 25, 2026 07:05 — with GitHub Actions Error

joshua-berri deployed to e2e-changed September 25, 2026 15:36 — with GitHub Actions Active

greptile-apps Bot reviewed Sep 25, 2026

View reviewed changes

Comment thread litellm/proxy/auth/handle_jwt.py Outdated

Comment thread litellm/proxy/agent_endpoints/auth/agent_permission_handler.py Outdated

Comment thread litellm/proxy/auth/user_api_key_auth.py Outdated

Comment thread litellm/proxy/management_endpoints/scim/agent_provisioning.py Outdated

cursor Bot reviewed Sep 25, 2026

View reviewed changes

Comment thread litellm/proxy/auth/handle_jwt.py Outdated

cursor Bot reviewed Sep 25, 2026

View reviewed changes

Comment thread litellm/proxy/agent_endpoints/auth/managed_authorization.py

veria-ai Bot reviewed Sep 25, 2026

View reviewed changes

Comment thread litellm/proxy/auth/handle_jwt.py Outdated

joshua-berri deployed to e2e-changed September 25, 2026 16:19 — with GitHub Actions Active

cursor Bot reviewed Sep 25, 2026

View reviewed changes

greptile-apps Bot reviewed Sep 25, 2026

View reviewed changes

Comment thread tests/test_litellm/proxy/agent_endpoints/auth/test_managed_authorization.py

joshua-berri deployed to e2e-changed September 25, 2026 16:35 — with GitHub Actions Active

cursor Bot reviewed Sep 25, 2026

View reviewed changes

greptile-apps Bot reviewed Sep 25, 2026

View reviewed changes

Comment thread litellm/proxy/agent_endpoints/auth/managed_authorization.py

veria-ai Bot reviewed Sep 25, 2026

View reviewed changes

Comment thread litellm/proxy/auth/auth_checks.py

joshua-berri had a problem deploying to e2e-changed September 25, 2026 16:54 — with GitHub Actions Failure

veria-ai Bot reviewed Sep 27, 2026

View reviewed changes

refactor(agents): defer optional team selector cleanup

1b0162b

joshua-berri deployed to e2e-changed September 27, 2026 20:44 — with GitHub Actions Active

joshua-berri mentioned this pull request Sep 27, 2026

fix(agents): preserve delegated team authorization context #43459

Draft

2 of 6 tasks

veria-ai Bot reviewed Sep 27, 2026

View reviewed changes

Comment thread litellm/proxy/agent_endpoints/auth/managed_authorization.py

fix(agents): enforce actor and target invocation rate limits

4ce23d0

joshua-berri had a problem deploying to e2e-changed September 27, 2026 21:02 — with GitHub Actions Error

greptile-apps Bot reviewed Sep 27, 2026

View reviewed changes

Comment thread litellm/proxy/hooks/parallel_request_limiter_v3.py Outdated

fix(agents): reconcile every reserved agent token counter

91c331a

joshua-berri deployed to e2e-changed September 27, 2026 21:15 — with GitHub Actions Active

style(agents): format rate descriptor construction

485bc29

joshua-berri deployed to e2e-changed September 27, 2026 21:28 — with GitHub Actions Active

veria-ai Bot reviewed Sep 27, 2026

View reviewed changes

fix(agents): pass rate policy without loop-local Final

080de40

joshua-berri deployed to e2e-changed September 27, 2026 21:53 — with GitHub Actions Active

Conversation

joshua-berri commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TLDR

User Flow

Relevant issues

Affected release

Linear ticket

Pre-Submission checklist

Screenshots / Proof of Fix

Type

Caveats

Final Attestation

Uh oh!

codspeed Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

codecov Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

joshua-berri commented Sep 25, 2026

Uh oh!

joshua-berri commented Sep 25, 2026

Uh oh!

greptile-apps Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

joshua-berri commented Sep 25, 2026

Uh oh!

joshua-berri commented Sep 25, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

veria-ai Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR overview

Open issues (2)

Uh oh!

joshua-berri commented Sep 25, 2026

Uh oh!

joshua-berri commented Sep 25, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

joshua-berri commented Sep 25, 2026

Uh oh!

joshua-berri commented Sep 25, 2026

Uh oh!

joshua-berri commented Sep 25, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

joshua-berri commented Sep 25, 2026

Uh oh!

joshua-berri commented Sep 25, 2026

joshua-berri commented Sep 25, 2026 •

edited

Loading

codspeed Bot commented Sep 25, 2026 •

edited

Loading

codecov Bot commented Sep 25, 2026 •

edited

Loading

greptile-apps Bot commented Sep 25, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

veria-ai Bot commented Sep 25, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading