Every Foundry and Copilot agent action,
independently judged before it executes.

# agent flow — "Veridect pre-action" is step 1; the work step runs only on greenlight
steps:
  - name: Veridect pre-action                       # HTTP action
    method: POST
    uri: https://<your-veridect-host>/api/ai/consensus/pre-action
    headers: { Authorization: "Bearer @{parameters('veridect_key')}", Content-Type: application/json }
    body:
      action:            "@{triggerBody()?['action']}"          # e.g. "reassign_case"
      target:            "dynamics365:@{triggerBody()?['entity']}"
      parameters:        "@{triggerBody()?['fields']}"
      callingAgent:      "@{parameters('agent_id')}"              # environment variable: the Entra Agent ID this flow belongs to — set by the maker, not an input
      callingAgentScope: "@{parameters('agent_scope')}"           # environment variable: its configured authority, in words — never a trigger input
    timeout: PT60S

  - name: Condition — proceed?
    expression: "@equals(body('Veridect_pre-action')?['verdict'], 'greenlight')"   # a failed step never reaches 'true'
    if_yes:
      - Update a row (Dataverse)                      # the work step — the record id goes into the note
    if_no:
      - Respond to the agent:
          "Not executed — Veridect @{body('Veridect_pre-action')?['verdict']} · record @{body('Veridect_pre-action')?['auditBundleId']}"

// Semantic Kernel function-invocation filter — one in front of every function the agent can call (Agent Framework's function middleware takes the same shape)
public sealed class VeridectFilter(HttpClient http, string agentId, string agentScope) : IFunctionInvocationFilter   // agentId + agentScope come from the agent's registration, never from the model
{
    public async Task OnFunctionInvocationAsync(FunctionInvocationContext ctx, Func<FunctionInvocationContext, Task> next)
    {
        var body = new {
            action            = ctx.Function.Name,                        // e.g. "release_vendor_payment"
            target            = "dynamics365_finance:" + ctx.Function.PluginName,
            parameters        = ctx.Arguments,
            callingAgent      = agentId,                                  // the agent's Entra Agent ID
            callingAgentScope = agentScope                                // its configured authority, in words
        };
        string verdict = "unavailable", recordId = "";                   // closed until proven open
        try {
            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(60));
            var r = await http.PostAsJsonAsync("/api/ai/consensus/pre-action", body, cts.Token);
            if (r.IsSuccessStatusCode) {
                var d = await r.Content.ReadFromJsonAsync<JsonElement>(cts.Token);
                verdict  = d.TryGetProperty("verdict", out var v)        ? v.GetString()  ?? "unavailable" : "unavailable";
                recordId = d.TryGetProperty("auditBundleId", out var id) ? id.GetString() ?? "" : "";
            }
        } catch { /* network, timeout, parse: all stay closed */ }

        if (verdict != "greenlight") {
            ctx.Result = new FunctionResult(ctx.Function, $"Not executed — Veridect {verdict} (record {recordId})");
            return;                                                        // the function body never runs
        }
        await next(ctx);                                                   // the work, with the record id in scope
    }
}
// kernel.FunctionInvocationFilters.Add(new VeridectFilter(http, agentId, agentScope));

# 1) once — register the real tool server as an upstream (admin call)
POST /api/ai/consensus/mcp/upstreams/{tenant}
{ "upstreamId": "foundry-tools-prod", "url": "https://<your-tool-server>/mcp", "enabled": true }

# 2) the one change — the backend behind the AI gateway (or the agent's MCP tool URL)
before:  https://<your-tool-server>/mcp
after:   https://<your-veridect-host>/api/mcp/gateway/foundry-tools-prod

# Foundry agent — the MCP tool definition, unchanged except for the URL
{ "type": "mcp", "server_label": "tools",
  "server_url": "https://<your-veridect-host>/api/mcp/gateway/foundry-tools-prod",
  "headers": { "Authorization": "Bearer <VERIDECT_API_KEY>",                # your Veridect tenant
               "X-Upstream-Authorization": "Bearer <tool-server token>" } }  # forwarded to the tool server

# 3) what the agent sees on a greenlight: the upstream's own result, plus
#    result._meta["veridect/verdict"] and result._meta["veridect/bundleId"]
#    on escalate / block: a JSON-RPC error (-32003 / -32004) carrying the
#    verdict and the record id — and the tool server never receives the call.