Function inputs are recorded: keep secrets out

Every decorated function's arguments and return value are written into its span and exported. A card number passed as an argument leaves your system.

Examplecard.py, after the setup lines

from agentops.sdk.decorators import operation


@operation
def charge(card_number, amount):
    return f"charged {amount} euros"


@agentops.trace(name="payment")
def pay():
    return charge("4111 1111 1111 1111", 40)

Examplecard.py, after the setup lines, continued

pay()
local_collector.flush()
for span in local_collector.SPANS:
    print(span["name"], span["attributes"].get("agentops.task.input"))

Example

python card.py

The card number is in the task.input attribute, exactly as passed. The SDK's _record_entity_input has a docstring saying it records "if content tracing is enabled", but the code records every time; there is no switch for decorator inputs in 0.4.21. Treat every argument of a decorated function as data you are sending to AgentOps.

Pass references, not secrets

Examplecard_safe.py, after the setup lines

from agentops.sdk.decorators import operation

CARDS = {"card-7": "4111 1111 1111 1111"}


@operation
def charge(card_id, amount):
    card_number = CARDS[card_id]  # looked up inside, never an argument
    return f"charged {amount} euros"


@agentops.trace(name="payment")
def pay():
    return charge("card-7", 40)

Examplecard_safe.py, after the setup lines, continued

pay()
local_collector.flush()
print(any("4111" in str(span["attributes"]) for span in local_collector.SPANS))

Example

python card_safe.py

The operation now takes a card_id and looks the number up inside. Nothing in any span contains 4111. Local variables are not recorded, only arguments and return values.

Check it, do not assume it

The same test, searching every exported attribute for known sensitive values, goes into the project's test suite in lesson 10. It fails the day someone adds a decorator to the wrong function.

Try it yourself

Return the card number from charge and run the check again.
Pass a customer's email address to an @operation and find it in the span.
Decorate a method of a class whose instance holds a password. Is the instance recorded?

PreviousSpan kinds: agents, operations and tools

This is what real progress feels like.