feat(agents): define Entra identity contracts and persistence

Co-authored-by: yassin <yassin@berri.ai>
2026-10-01 02:02:20 +00:00 · 2026-09-26 11:32:41 -07:00 · 2026-09-26 11:32:41 -07:00 · 3f73afcd45
commit 3f73afcd45
parent 96c008f420
7 changed files with 515 additions and 0 deletions
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260921190000_agent_identity/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260921190000_agent_identity/migration.sql
@ -0,0 +1,97 @@
+-- AlterTable
+ALTER TABLE "LiteLLM_AgentsTable" ADD COLUMN IF NOT EXISTS "enabled" BOOLEAN NOT NULL DEFAULT true,
+ADD COLUMN IF NOT EXISTS "execution_mode" TEXT NOT NULL DEFAULT 'autonomous',
+ADD COLUMN IF NOT EXISTS "identity_managed" BOOLEAN NOT NULL DEFAULT false;
+
+-- AlterTable
+ALTER TABLE "LiteLLM_SpendLogs" ADD COLUMN IF NOT EXISTS "billing_agent_id" TEXT;
+
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "LiteLLM_AgentIdentity" (
+    "agent_id" TEXT NOT NULL,
+    "active" BOOLEAN NOT NULL DEFAULT true,
+    "provider" TEXT NOT NULL,
+    "issuer" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "service_principal_id" TEXT,
+    "required_roles" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "required_scopes" TEXT[] DEFAULT ARRAY['user_impersonation']::TEXT[],
+    "revision" TEXT NOT NULL,
+    "last_authenticated_at" TIMESTAMP(3),
+
+    CONSTRAINT "LiteLLM_AgentIdentity_pkey" PRIMARY KEY ("agent_id")
+);
+
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "LiteLLM_RetiredAgentIdentity" (
+    "binding_id" TEXT NOT NULL,
+    "agent_id" TEXT,
+    "provider" TEXT NOT NULL,
+    "issuer" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+
+    CONSTRAINT "LiteLLM_RetiredAgentIdentity_pkey" PRIMARY KEY ("binding_id")
+);
+
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "LiteLLM_RetiredAgent" (
+    "original_agent_id" TEXT NOT NULL,
+    "retired_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "LiteLLM_RetiredAgent_pkey" PRIMARY KEY ("original_agent_id")
+);
+
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "LiteLLM_VerifiedSubject" (
+    "subject_id" TEXT NOT NULL,
+    "issuer" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "oid" TEXT NOT NULL,
+    "kind" TEXT NOT NULL DEFAULT 'human',
+    "user_id" TEXT,
+    "verified_via" TEXT NOT NULL DEFAULT 'sso_interactive',
+    "verified_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "LiteLLM_VerifiedSubject_pkey" PRIMARY KEY ("subject_id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_AgentIdentity_provider_tenant_id_client_id_key" ON "LiteLLM_AgentIdentity"("provider", "tenant_id", "client_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_AgentIdentity_issuer_service_principal_id_key" ON "LiteLLM_AgentIdentity"("issuer", "service_principal_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_RetiredAgentIdentity_provider_tenant_id_client_id_key" ON "LiteLLM_RetiredAgentIdentity"("provider", "tenant_id", "client_id");
+
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "LiteLLM_VerifiedSubject_user_id_idx" ON "LiteLLM_VerifiedSubject"("user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX IF NOT EXISTS "LiteLLM_VerifiedSubject_issuer_tenant_id_oid_key" ON "LiteLLM_VerifiedSubject"("issuer", "tenant_id", "oid");
+
+-- AddForeignKey
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'LiteLLM_AgentIdentity_agent_id_fkey') THEN
+        ALTER TABLE "LiteLLM_AgentIdentity" ADD CONSTRAINT "LiteLLM_AgentIdentity_agent_id_fkey" FOREIGN KEY ("agent_id") REFERENCES "LiteLLM_AgentsTable"("agent_id") ON DELETE CASCADE ON UPDATE CASCADE;
+    END IF;
+END $$;
+
+-- AddForeignKey
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'LiteLLM_RetiredAgentIdentity_agent_id_fkey') THEN
+        ALTER TABLE "LiteLLM_RetiredAgentIdentity" ADD CONSTRAINT "LiteLLM_RetiredAgentIdentity_agent_id_fkey" FOREIGN KEY ("agent_id") REFERENCES "LiteLLM_AgentsTable"("agent_id") ON DELETE SET NULL ON UPDATE CASCADE;
+    END IF;
+END $$;
+
+-- AddForeignKey
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'LiteLLM_VerifiedSubject_user_id_fkey') THEN
+        ALTER TABLE "LiteLLM_VerifiedSubject" ADD CONSTRAINT "LiteLLM_VerifiedSubject_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "LiteLLM_UserTable"("user_id") ON DELETE CASCADE ON UPDATE CASCADE;
+    END IF;
+END $$;
--- a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
+++ b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
@ -78,6 +78,11 @@ model LiteLLM_AgentsTable {
  object_permission_id String?
  object_permission LiteLLM_ObjectPermissionTable? @relation(fields: [object_permission_id], references: [object_permission_id])
  spend      Float    @default(0.0)
+  identity_managed Boolean @default(false)
+  enabled Boolean @default(true)
+  execution_mode String @default("autonomous")
+  identity LiteLLM_AgentIdentity?
+  retired_identities LiteLLM_RetiredAgentIdentity[]
  tpm_limit  Int?
  rpm_limit  Int?
  session_tpm_limit Int?
@ -88,6 +93,56 @@ model LiteLLM_AgentsTable {
  updated_by String
 }

+model LiteLLM_AgentIdentity {
+  agent_id String @id
+  active Boolean @default(true)
+  agent LiteLLM_AgentsTable @relation(fields: [agent_id], references: [agent_id], onDelete: Cascade)
+  provider String
+  issuer String
+  tenant_id String
+  client_id String
+  service_principal_id String?
+  required_roles String[] @default([])
+  required_scopes String[] @default(["user_impersonation"])
+  revision String @default(uuid())
+  last_authenticated_at DateTime?
+  @@unique([provider, tenant_id, client_id])
+  @@unique([issuer, service_principal_id])
+}
+
+model LiteLLM_RetiredAgentIdentity {
+  binding_id String @id @default(uuid())
+  agent_id String?
+  agent LiteLLM_AgentsTable? @relation(fields: [agent_id], references: [agent_id], onDelete: SetNull)
+  provider String
+  issuer String
+  tenant_id String
+  client_id String
+  @@unique([provider, tenant_id, client_id])
+}
+
+model LiteLLM_RetiredAgent {
+  original_agent_id String @id
+  retired_at DateTime @default(now())
+}
+
+model LiteLLM_VerifiedSubject {
+  subject_id String @id @default(uuid())
+  issuer String
+  tenant_id String
+  oid String
+  kind String @default("human")
+  user_id String?
+  user LiteLLM_UserTable? @relation(fields: [user_id], references: [user_id], onDelete: Cascade)
+  verified_via String @default("sso_interactive")
+  verified_at DateTime @default(now())
+  @@unique([issuer, tenant_id, oid])
+  @@index([user_id])
+}
+
+
+
+
 model LiteLLM_OrganizationTable {
 		organization_id String @id @default(uuid())
    organization_alias  String
@ -241,6 +296,7 @@ model LiteLLM_DeletedTeamTable {

 // Track spend, rate limit, budget Users
 model LiteLLM_UserTable {
+    verified_subjects LiteLLM_VerifiedSubject[]
 		user_id    String @id
    user_alias String? 
    team_id    String?
@ -674,6 +730,7 @@ model LiteLLM_SpendLogs {
  session_id          String?
  status              String?
  mcp_namespaced_tool_name String? 
+  billing_agent_id    String?
  agent_id            String?
  proxy_server_request Json?     @default("{}")
  litellm_call_id     String?
--- a/litellm/proxy/agent_endpoints/managed_identity.py
+++ b/litellm/proxy/agent_endpoints/managed_identity.py
@ -0,0 +1,45 @@
+from collections.abc import Mapping
+from typing import Final
+
+from litellm.types.proxy.agent_identity import (
+    AgentExecutionMode,
+    AgentIdentityBinding,
+    AgentIdentityFailure,
+    AgentSubject,
+)
+
+
+def classify_agent_subject(
+    binding: AgentIdentityBinding,
+    claims: Mapping[str, object],
+    allowed_mode: AgentExecutionMode,
+) -> AgentSubject | AgentIdentityFailure:
+    if (claims.get("iss"), claims.get("tid"), claims.get("azp")) != (
+        binding.issuer,
+        binding.tenant_id,
+        binding.client_id,
+    ):
+        return AgentIdentityFailure(message="Token does not match the registered Entra application")
+    oid: Final = claims.get("oid")
+    if not isinstance(oid, str) or not oid:
+        return AgentIdentityFailure(message="Entra token must identify its object subject")
+    scope: Final = claims.get("scp")
+    facets: Final = claims.get("xms_sub_fct")
+    if facets is not None and (not isinstance(facets, str) or "13" in facets.split()):
+        return AgentIdentityFailure(message="Native agent-user authentication is not supported by this binding")
+    if scope is not None and not isinstance(scope, str):
+        return AgentIdentityFailure(message="Invalid delegated scope claim")
+    if isinstance(scope, str) and scope:
+        if allowed_mode == "autonomous" or oid == binding.service_principal_id or claims.get("idtyp") == "app":
+            return AgentIdentityFailure(message="Delegated token contradicts the configured agent identity or mode")
+        if not binding.required_scopes or not frozenset(binding.required_scopes).issubset(scope.split()):
+            return AgentIdentityFailure(message="Token lacks the required delegated scopes")
+        return AgentSubject(kind="delegated_subject", oid=oid, mode="delegated")
+    if allowed_mode == "delegated" or oid != binding.service_principal_id or claims.get("idtyp") == "user":
+        return AgentIdentityFailure(message="Application token contradicts the configured agent identity or mode")
+    roles: Final = claims.get("roles", ())
+    if not isinstance(roles, (list, tuple)) or any(not isinstance(role, str) for role in roles):
+        return AgentIdentityFailure(message="Invalid application roles claim")
+    if not frozenset(binding.required_roles).issubset(roles):
+        return AgentIdentityFailure(message="Token lacks the required application roles")
+    return AgentSubject(kind="application", oid=oid, mode="autonomous")
--- a/litellm/proxy/schema.prisma
+++ b/litellm/proxy/schema.prisma
@ -78,6 +78,11 @@ model LiteLLM_AgentsTable {
  object_permission_id String?
  object_permission LiteLLM_ObjectPermissionTable? @relation(fields: [object_permission_id], references: [object_permission_id])
  spend      Float    @default(0.0)
+  identity_managed Boolean @default(false)
+  enabled Boolean @default(true)
+  execution_mode String @default("autonomous")
+  identity LiteLLM_AgentIdentity?
+  retired_identities LiteLLM_RetiredAgentIdentity[]
  tpm_limit  Int?
  rpm_limit  Int?
  session_tpm_limit Int?
@ -88,6 +93,56 @@ model LiteLLM_AgentsTable {
  updated_by String
 }

+model LiteLLM_AgentIdentity {
+  agent_id String @id
+  active Boolean @default(true)
+  agent LiteLLM_AgentsTable @relation(fields: [agent_id], references: [agent_id], onDelete: Cascade)
+  provider String
+  issuer String
+  tenant_id String
+  client_id String
+  service_principal_id String?
+  required_roles String[] @default([])
+  required_scopes String[] @default(["user_impersonation"])
+  revision String @default(uuid())
+  last_authenticated_at DateTime?
+  @@unique([provider, tenant_id, client_id])
+  @@unique([issuer, service_principal_id])
+}
+
+model LiteLLM_RetiredAgentIdentity {
+  binding_id String @id @default(uuid())
+  agent_id String?
+  agent LiteLLM_AgentsTable? @relation(fields: [agent_id], references: [agent_id], onDelete: SetNull)
+  provider String
+  issuer String
+  tenant_id String
+  client_id String
+  @@unique([provider, tenant_id, client_id])
+}
+
+model LiteLLM_RetiredAgent {
+  original_agent_id String @id
+  retired_at DateTime @default(now())
+}
+
+model LiteLLM_VerifiedSubject {
+  subject_id String @id @default(uuid())
+  issuer String
+  tenant_id String
+  oid String
+  kind String @default("human")
+  user_id String?
+  user LiteLLM_UserTable? @relation(fields: [user_id], references: [user_id], onDelete: Cascade)
+  verified_via String @default("sso_interactive")
+  verified_at DateTime @default(now())
+  @@unique([issuer, tenant_id, oid])
+  @@index([user_id])
+}
+
+
+
+
 model LiteLLM_OrganizationTable {
 		organization_id String @id @default(uuid())
    organization_alias  String
@ -241,6 +296,7 @@ model LiteLLM_DeletedTeamTable {

 // Track spend, rate limit, budget Users
 model LiteLLM_UserTable {
+    verified_subjects LiteLLM_VerifiedSubject[]
 		user_id    String @id
    user_alias String? 
    team_id    String?
@ -674,6 +730,7 @@ model LiteLLM_SpendLogs {
  session_id          String?
  status              String?
  mcp_namespaced_tool_name String? 
+  billing_agent_id    String?
  agent_id            String?
  proxy_server_request Json?     @default("{}")
  litellm_call_id     String?
--- a/litellm/types/proxy/agent_identity.py
+++ b/litellm/types/proxy/agent_identity.py
@ -0,0 +1,93 @@
+from datetime import datetime
+from typing import Literal, TypeAlias
+from uuid import UUID
+
+from pydantic import BaseModel, ConfigDict, field_validator
+
+AgentExecutionMode: TypeAlias = Literal["autonomous", "delegated", "both"]
+
+
+class EntraIdentityConfig(BaseModel):
+    model_config = ConfigDict(frozen=True, extra="forbid")
+
+    provider: Literal["microsoft_entra"]
+    tenant_id: str
+    client_id: str
+    service_principal_id: str | None = None
+    required_roles: tuple[str, ...] = ()
+    required_scopes: tuple[str, ...] = ("user_impersonation",)
+
+    @field_validator("tenant_id", "client_id", "service_principal_id")
+    @classmethod
+    def normalize_identifier(cls, value: str | None) -> str | None:
+        return str(UUID(value)) if value is not None else None
+
+    @property
+    def issuer(self) -> str:
+        return f"https://login.microsoftonline.com/{self.tenant_id}/v2.0"
+
+
+class AgentIdentityBinding(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    agent_id: str
+    active: bool = True
+    provider: Literal["microsoft_entra"]
+    tenant_id: str
+    client_id: str
+    service_principal_id: str | None = None
+    issuer: str
+    required_roles: tuple[str, ...] = ()
+    required_scopes: tuple[str, ...] = ("user_impersonation",)
+    revision: str
+    last_authenticated_at: datetime | None = None
+
+
+class AgentSubject(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    kind: Literal["application", "delegated_subject"]
+    oid: str
+    mode: Literal["autonomous", "delegated"]
+
+
+class AgentIdentityFailure(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    code: Literal["identity_denied", "policy_unavailable"] = "identity_denied"
+    message: str
+
+
+class ManagedAgentContext(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    agent_id: str
+    binding_revision: str | None = None
+    mode: Literal["autonomous", "delegated"]
+    user_id: str | None = None
+    subject_oid: str | None = None
+
+
+class VerifiedHumanSubject(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    issuer: str
+    tenant_id: str
+    oid: str
+    user_id: str
+
+
+class MicrosoftInteractiveSubject(BaseModel):
+    model_config = ConfigDict(frozen=True)
+
+    issuer: str
+    tenant_id: str
+    oid: str
+
+
+class ManagedAgentIdentityStatus(BaseModel):
+    identity: AgentIdentityBinding | None = None
+    identity_managed: bool = False
+    enabled: bool = True
+    execution_mode: AgentExecutionMode = "autonomous"
+    last_authenticated_at: datetime | None = None
--- a/schema.prisma
+++ b/schema.prisma
@ -78,6 +78,11 @@ model LiteLLM_AgentsTable {
  object_permission_id String?
  object_permission LiteLLM_ObjectPermissionTable? @relation(fields: [object_permission_id], references: [object_permission_id])
  spend      Float    @default(0.0)
+  identity_managed Boolean @default(false)
+  enabled Boolean @default(true)
+  execution_mode String @default("autonomous")
+  identity LiteLLM_AgentIdentity?
+  retired_identities LiteLLM_RetiredAgentIdentity[]
  tpm_limit  Int?
  rpm_limit  Int?
  session_tpm_limit Int?
@ -88,6 +93,56 @@ model LiteLLM_AgentsTable {
  updated_by String
 }

+model LiteLLM_AgentIdentity {
+  agent_id String @id
+  active Boolean @default(true)
+  agent LiteLLM_AgentsTable @relation(fields: [agent_id], references: [agent_id], onDelete: Cascade)
+  provider String
+  issuer String
+  tenant_id String
+  client_id String
+  service_principal_id String?
+  required_roles String[] @default([])
+  required_scopes String[] @default(["user_impersonation"])
+  revision String @default(uuid())
+  last_authenticated_at DateTime?
+  @@unique([provider, tenant_id, client_id])
+  @@unique([issuer, service_principal_id])
+}
+
+model LiteLLM_RetiredAgentIdentity {
+  binding_id String @id @default(uuid())
+  agent_id String?
+  agent LiteLLM_AgentsTable? @relation(fields: [agent_id], references: [agent_id], onDelete: SetNull)
+  provider String
+  issuer String
+  tenant_id String
+  client_id String
+  @@unique([provider, tenant_id, client_id])
+}
+
+model LiteLLM_RetiredAgent {
+  original_agent_id String @id
+  retired_at DateTime @default(now())
+}
+
+model LiteLLM_VerifiedSubject {
+  subject_id String @id @default(uuid())
+  issuer String
+  tenant_id String
+  oid String
+  kind String @default("human")
+  user_id String?
+  user LiteLLM_UserTable? @relation(fields: [user_id], references: [user_id], onDelete: Cascade)
+  verified_via String @default("sso_interactive")
+  verified_at DateTime @default(now())
+  @@unique([issuer, tenant_id, oid])
+  @@index([user_id])
+}
+
+
+
+
 model LiteLLM_OrganizationTable {
 		organization_id String @id @default(uuid())
    organization_alias  String
@ -241,6 +296,7 @@ model LiteLLM_DeletedTeamTable {

 // Track spend, rate limit, budget Users
 model LiteLLM_UserTable {
+    verified_subjects LiteLLM_VerifiedSubject[]
 		user_id    String @id
    user_alias String? 
    team_id    String?
@ -674,6 +730,7 @@ model LiteLLM_SpendLogs {
  session_id          String?
  status              String?
  mcp_namespaced_tool_name String? 
+  billing_agent_id    String?
  agent_id            String?
  proxy_server_request Json?     @default("{}")
  litellm_call_id     String?
--- a/tests/test_litellm/proxy/agent_endpoints/test_managed_identity.py
+++ b/tests/test_litellm/proxy/agent_endpoints/test_managed_identity.py
@ -0,0 +1,109 @@
+from typing import Final
+
+import pytest
+
+from litellm.proxy.agent_endpoints.managed_identity import classify_agent_subject
+from litellm.types.proxy.agent_identity import AgentIdentityBinding, AgentIdentityFailure, AgentSubject
+
+TENANT: Final = "11111111-1111-4111-8111-111111111111"
+CLIENT: Final = "22222222-2222-4222-8222-222222222222"
+PRINCIPAL: Final = "33333333-3333-4333-8333-333333333333"
+HUMAN: Final = "44444444-4444-4444-8444-444444444444"
+ISSUER: Final = f"https://login.microsoftonline.com/{TENANT}/v2.0"
+BINDING: Final = AgentIdentityBinding(
+    agent_id="agent-one",
+    provider="microsoft_entra",
+    tenant_id=TENANT,
+    client_id=CLIENT,
+    service_principal_id=PRINCIPAL,
+    issuer=ISSUER,
+    required_roles=("Agent.Invoke",),
+    required_scopes=("user_impersonation",),
+    revision="binding-one",
+)
+
+
+def claims(**overrides: object) -> dict[str, object]:
+    return {"iss": ISSUER, "tid": TENANT, "azp": CLIENT, "oid": PRINCIPAL, "roles": ["Agent.Invoke"], **overrides}
+
+
+def test_autonomous_identity_needs_no_human_and_checks_the_pinned_principal() -> None:
+    result: Final = classify_agent_subject(BINDING, claims(), "autonomous")
+    assert result == AgentSubject(kind="application", oid=PRINCIPAL, mode="autonomous")
+    assert isinstance(classify_agent_subject(BINDING, claims(oid=HUMAN), "autonomous"), AgentIdentityFailure)
+
+
+@pytest.mark.parametrize(
+    "overrides",
+    [
+        {"iss": "https://untrusted.example"},
+        {"tid": CLIENT},
+        {"azp": TENANT},
+        {"roles": []},
+        {"idtyp": "user"},
+        {"scp": "user_impersonation"},
+        {"scp": 1},
+        {"oid": None},
+    ],
+)
+def test_application_rejects_mismatched_or_contradictory_verified_claims(overrides: dict[str, object]) -> None:
+    assert isinstance(classify_agent_subject(BINDING, claims(**overrides), "both"), AgentIdentityFailure)
+
+
+def test_delegated_profile_identifies_a_subject_without_asserting_that_it_is_human() -> None:
+    result: Final = classify_agent_subject(BINDING, claims(oid=HUMAN, scp="user_impersonation"), "delegated")
+    assert result == AgentSubject(kind="delegated_subject", oid=HUMAN, mode="delegated")
+
+
+@pytest.mark.parametrize(
+    "overrides",
+    [
+        {"scp": "unrelated"},
+        {"scp": ""},
+        {"idtyp": "app"},
+        {"xms_sub_fct": "2 13 15"},
+        {"xms_sub_fct": [13]},
+    ],
+)
+def test_delegated_profile_rejects_unknown_scope_and_known_nonhuman_subjects(overrides: dict[str, object]) -> None:
+    assert isinstance(
+        classify_agent_subject(BINDING, claims(**{"oid": HUMAN, "scp": "user_impersonation", **overrides}), "both"),
+        AgentIdentityFailure,
+    )
+
+
+def test_allowed_mode_cannot_be_selected_by_the_caller() -> None:
+    assert isinstance(classify_agent_subject(BINDING, claims(), "delegated"), AgentIdentityFailure)
+    assert isinstance(
+        classify_agent_subject(BINDING, claims(oid=HUMAN, scp="user_impersonation"), "autonomous"),
+        AgentIdentityFailure,
+    )
+
+
+def test_native_facet_absence_does_not_establish_human_identity() -> None:
+    result: Final = classify_agent_subject(
+        BINDING, claims(oid=HUMAN, scp="user_impersonation", xms_sub_fct="113"), "both"
+    )
+    assert isinstance(result, AgentSubject)
+    assert result.kind == "delegated_subject"
+
+
+@pytest.mark.parametrize("roles", ["Agent.Invoke", [42], None])
+def test_malformed_application_roles_are_rejected(roles: object) -> None:
+    result: Final = classify_agent_subject(BINDING, claims(roles=roles), "autonomous")
+    assert isinstance(result, AgentIdentityFailure)
+    assert "Invalid application roles" in result.message
+
+
+def test_entra_binding_normalizes_identifiers_and_rejects_invalid_configuration() -> None:
+    from pydantic import ValidationError
+    from litellm.types.proxy.agent_identity import EntraIdentityConfig
+
+    identifier = "ABCDEF00-1234-4234-9234-123456789ABC"
+    config = EntraIdentityConfig(provider="microsoft_entra", tenant_id=identifier, client_id=identifier)
+    assert config.tenant_id == identifier.lower()
+    assert config.client_id == identifier.lower()
+    assert config.service_principal_id is None
+    assert config.issuer == f"https://login.microsoftonline.com/{config.tenant_id}/v2.0"
+    with pytest.raises(ValidationError):
+        EntraIdentityConfig(provider="microsoft_entra", tenant_id="invalid", client_id=identifier)