Python: Integration: AffixIO host-side attestation for tool/plugin execution (IFunctionInvocationFilter)

Summary

Proposal to document (and optionally sample) AffixIO as a host-side approval/attestation layer around Semantic Kernel tool and plugin execution, using the existing IFunctionInvocationFilter / function-invocation approval path.

AffixIO proves a host-side action completed (signed yes/no). It is not identity, age, or KYC. PII stays on the host.

Why this fits SK

SK already has:

• IFunctionInvocationFilter for intercepting kernel function calls
• the FunctionInvocationApproval demo sample under dotnet/samples/Demos/

AffixIO sits in that same place: gate privileged plugin/tool calls (secret use, remediations, admin actions) on the host before they run, then emit a signed yes/no attestation that the gate completed.

This is useful for agent orchestration where an LLM can select tools, but the enterprise needs a host-side proof that a human or policy gate actually approved the privileged call.

Minimal integration shape (no full middleware wrap)

1. Install:

npm i affixio
# optional local MCP (stdio)
npm i @affixio/[email protected]

1. In an IFunctionInvocationFilter (or Python equivalent filter), before invoking a privileged function:

• call AffixIO to require host-side approval for that action
• proceed only on signed yes
• optionally attach the attestation id/result to logs/traces

1. Keep AffixIO out of model prompts and out of PII paths. It attests the action, not the person.

Docs / sample ask

Happy to contribute a minimal sample (filter + AffixIO call) if maintainers want it under samples/docs. Not proposing a full AffixIO SDK wrap inside this repo.

Noting the README migration notice toward Microsoft Agent Framework; same filter/approval pattern should map there too. Filing here because SK still has the live filter APIs and approval demo.

Links

• Product: https://www.affix-io.com/
• Onboarding: https://hub.affix-io.com/onboarding/

Ask

1. Is an AffixIO mention or minimal sample under filters/approval docs welcome?
2. Preferred target: Semantic Kernel samples, or Agent Framework equivalents?

Happy to follow maintainer guidance before any PR.