Python: [.NET][Python] Enforce Purview policy on cold scope cache

[eoindoherty1]

Motivation & Context

Purview policy enforcement could call ProcessContent without inline evaluation while the protection-scopes cache was cold. Because scope retrieval happens asynchronously, the first message could complete without the server evaluating applicable policies.

This change keeps protection-scope retrieval off the foreground path while ensuring the initial ProcessContent request asks the service to evaluate applicable policies inline.

Description & Review Guide

• What are the major changes? Cold-cache ProcessContent requests now enable inline evaluation in both .NET and Python. The existing background scope refresh continues to populate the cache and records content activity only when the retrieved scopes show that no policy applies. Regression coverage verifies inline cold requests, blocking responses, cache population, conditional content-activity handling, and payment-required behavior.
• What is the impact of these changes? The first request after a cache miss can enforce applicable Purview policy without waiting for scope retrieval. Warm-cache behavior is unchanged.
• What do you want reviewers to focus on? The cold-cache ordering and the contract between foreground inline evaluation and background scope refresh.

Validations

Dotnet E2E:

Python E2E:

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Pull request overview

Enforces inline Purview evaluation when the protection-scopes cache is cold across .NET and Python.

Changes:

• Enables inline evaluation on cold-cache requests.
• Expands regression coverage for cache refresh and policy handling.
• Updates scope-retrieval job documentation.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
python/packages/purview/tests/purview/test_processor.py	Verifies cold requests use inline evaluation.
python/packages/purview/agent_framework_purview/_processor.py	Enables inline evaluation on cache misses.
dotnet/tests/Microsoft.Agents.AI.Purview.UnitTests/ScopedContentProcessorTests.cs	Expands cold-cache and background-job tests.
dotnet/src/Microsoft.Agents.AI.Purview/ScopedContentProcessor.cs	Adds inline cold-cache processing.
dotnet/src/Microsoft.Agents.AI.Purview/Models/Jobs/ScopeRetrievalJob.cs	Simplifies job documentation.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (3 commit(s)): e41043d05dc9, 6d0d3a93456d, 36424bab16a3
Model: gpt-5.6-sol

Overview

The change correctly requests inline Purview evaluation on cold scope caches in both implementations, and tests cover blocking responses, cache population, conditional activity recording, and payment-required behavior. Warm-cache behavior remains isolated from the new path. However, the .NET path now makes foreground policy enforcement depend on admission to a shared bounded background queue, allowing sustained cold-cache traffic to deny unrelated requests.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 high) across 1 file. Details are attached to the affected lines below.

Affected areas: dotnet/src/Microsoft.Agents.AI.Purview/ScopedContentProcessor.cs

[github-actions]

MAF Automated Review — Iteration 2

Result: No findings
Scope: 22 net-new commit(s): 1aca2a95e3b9, 4c0bff8b77d5, a617392cc79b, 5996105a1bf2, d2a934d53530, 018dea570b84, 11d628d60ff2, 6a0773ba2180, 8b0aea17663c, 2955888d5512, 9ca957148efd, 0822dd7495d9, 575b408e0ec8, 0b74e0d73133, 362972afb701, b03792465563, 486b5d0267f8, ab9ce3d4649d, e2f7db207cb6, 8ea6f8345dbd, baf0ea5252eb, e64987e400d8
Model: gpt-5.6-sol

Overview

The incremental change resolves the previously reported dependency between foreground inline enforcement and background queue admission. It catches Purview queue failures narrowly, preserves the foreground ProcessContent call, and adds regression coverage proving inline evaluation still occurs after admission failure. No residual Critical, High, or Medium defect was established on a changed line in the supplied diff.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.