Python: feat: governance filter for function calls — deterministic policy evaluation, cost tracking, audit (TealTiger)

Is your feature request related to a problem? Please describe.

Semantic Kernel's Filter system (IFunctionInvocationFilter, IAutoFunctionInvocationFilter) provides the right interception points for governance, but there's no built-in or community governance filter that:

• Evaluates deterministic policies before function/plugin execution
• Enforces per-agent cost budgets (block calls that would exceed daily/session limits)
• Tracks and attributes LLM cost per agent, per plugin, per session
• Produces structured audit records for compliance (EU AI Act Article 12)
• Provides per-provider circuit breaking to prevent cascading failures

Today you'd need to implement custom IFunctionInvocationFilter logic in every project, which doesn't scale.

Describe the solution you'd like

A governance filter that plugs into SK's existing filter pipeline:

Python:

from semantic_kernel import Kernel
from sk_tealtiger import TealTigerFilter

kernel = Kernel()

# Zero-config: observe all function calls, track cost, detect PII
kernel.add_filter("function_invocation", TealTigerFilter())

# With policies
from tealtiger import TealEngine
engine = TealEngine(policies=company_policies, mode="ENFORCE")
kernel.add_filter("function_invocation", TealTigerFilter(engine=engine))

C# (if community demand exists):

var kernel = Kernel.CreateBuilder()
    .AddFilter<TealTigerGovernanceFilter>()
    .Build();

The filter would:

• Intercept FunctionInvocationContext before execution
• Evaluate policy against the function name, arguments, and caller context
• Return ALLOW (proceed), DENY (throw), or REVISE (modify args)
• Track token cost after execution and check against budget limits
• Emit structured audit entries with correlation IDs
• Circuit-break on repeated provider failures

Describe alternatives you've considered

• Custom IFunctionInvocationFilter per project — works but verbose, no reuse across projects
• External proxy/sidecar — adds network latency, incompatible with offline/in-process constraint
• Azure Content Safety service — cloud-dependent, LLM-based (non-deterministic), doesn't handle cost/budget/tool-restriction

Additional context

• TealTiger — open-source AI agent security platform (Apache-2.0, NVIDIA Inception)
• Published on PyPI (tealtiger v1.3.0) and npm (tealtiger-ai-sdk v0.1.0)
• Covers 8/10 OWASP Agentic Security Index categories
• All governance is deterministic and in-process — no external service, <5ms overhead, works offline
• Already integrated with LangChain, Vercel AI SDK, CrewAI, and proposals open for LlamaIndex, AG2, Haystack, Pydantic AI, Mastra
• SK's existing Filter system (per blog post) is the natural integration point
• EU AI Act compliance angle: structured audit records with retention_until, input/output traceability

References:

• https://github.com/agentguard-ai/tealtiger — TealTiger source (Apache-2.0)
• https://pypi.org/project/tealtiger/ — TealTiger on PyPI (v1.3.0)
• https://www.npmjs.com/package/tealtiger-ai-sdk — Vercel AI SDK middleware (v0.1.0)
• https://devblogs.microsoft.com/agent-framework/filters-in-semantic-kernel/ — SK Filters blog post
• https://owasp.org/www-project-top-10-for-large-language-model-applications/ — OWASP Agentic Security Index

Contribution plan: Happy to contribute a Python IFunctionInvocationFilter implementation as a community sample or standalone pip package. Would this be welcome as a sample in the repo or as an external community integration?

Start with the Python IFunctionInvocationFilter and FunctionInvocationContext entry points, along with Semantic Kernel's existing filter documentation and pipeline. Clarify whether the work belongs as a repository sample or an external integration, then define a bounded first scope and acceptance criteria for policy evaluation, cost tracking, audit records, and provider circuit breaking.