fix(telemetry): resolve F-07 enforce private identity export

Author: Aitomates

docs/architecture.md

@@ -30,4 +30,5 @@ The Foundry call is isolated behind the `WorkflowAgentService` protocol. This ke
 - `cas.workflow.execute` covers core orchestration.
 - `foundry.responses.create` covers the external Foundry call.
 - CAS correlation IDs are attached to workflow spans and canonical events preserve W3C trace context.
-
+- Broad Azure SDK and outbound HTTP auto-instrumentation is disabled to avoid capturing prompt or
+  output content. The application records only explicit boundary spans and safe identifiers.

docs/operations.md

@@ -15,7 +15,11 @@ Set `ENVIRONMENT` to `dev`, `test`, or `prod`; set `WORKFLOW_BACKEND=foundry`; p
 
 Readiness fails until required Foundry identifiers are present. Foundry connectivity is exercised only by workflow requests, not probes.
 
+When `APPLICATIONINSIGHTS_CONNECTION_STRING` is supplied, telemetry export also authenticates with
+the environment credential. Grant the system-assigned identity the minimum Azure Monitor publishing
+role required by the deployment. Retry-file storage and broad outbound HTTP/SDK auto-instrumentation
+are disabled; explicit spans do not record prompt or output content.
+
 ## Platform Handoff
 
 Build a Linux AMD64 image and pass its immutable image reference to the `containerImage` parameter of `cas-platform`. Review `deployment/cas-platform.interface.yaml` before platform changes. This repository intentionally contains no Azure deployment command.
-

docs/threat-model.md

@@ -21,7 +21,7 @@
 | Credential disclosure | No keys or tokens in code; system-assigned `ManagedIdentityCredential` in Azure | Operators must maintain least-privilege RBAC |
 | Legacy API use | Adapter uses project Responses client with `agent_reference`; no Classic Assistants code | SDK behavior must be reviewed during upgrades |
 | Prompt injection | Workflow treats prompts as untrusted data and exposes no tools in v0.1 | Downstream agent policy remains product-specific |
-| Sensitive telemetry | Events contain identifiers and status, not prompt text or agent output | Operators must review SDK and platform log settings |
+| Sensitive telemetry | Explicit spans contain safe identifiers only; broad outbound HTTP/SDK auto-instrumentation and retry-file storage are disabled | Operators must review platform log settings |
 | Unauthorized invocation | External ingress disabled by default in platform interface | Authentication gateway is product-specific and out of scope |
 | Supply-chain compromise | Pinned CI actions, lint, tests, non-root container | Dependency update review remains required |
 | Denial of service | Platform scaling bounds and request validation | Product-specific quotas and rate limits are not included |
@@ -30,3 +30,5 @@
 
 Grant the Container App system-assigned identity only the minimum Foundry project role needed to invoke the selected agent, scoped to the narrowest resource. Do not assign subscription-wide roles.
 
+When Application Insights export is enabled, also grant the minimum Azure Monitor publishing role
+required by the deployment at the narrowest telemetry resource scope.

src/cas_reference_product/telemetry.py

@@ -1,6 +1,7 @@
 from opentelemetry import trace
 
 from .config import Settings
+from .identity import build_credential
 
 
 def configure_telemetry(settings: Settings) -> None:
@@ -9,6 +10,14 @@ def configure_telemetry(settings: Settings) -> None:
 
         configure_azure_monitor(
             connection_string=settings.applicationinsights_connection_string,
+            credential=build_credential(settings.environment),
+            disable_offline_storage=True,
+            instrumentation_options={
+                "azure_sdk": {"enabled": False},
+                "requests": {"enabled": False},
+                "urllib": {"enabled": False},
+                "urllib3": {"enabled": False},
+            },
             service_name=settings.app_name,
         )
 

tests/test_telemetry.py

@@ -5,7 +5,37 @@
 
 
 def test_telemetry_is_noop_without_application_insights() -> None:
-    configure_telemetry(Settings())
+    with patch("cas_reference_product.telemetry.build_credential") as credential:
+        configure_telemetry(Settings())
+    credential.assert_not_called()
+
+
+def test_telemetry_uses_identity_and_privacy_hardening() -> None:
+    settings = Settings(
+        environment="prod",
+        applicationinsights_connection_string=(
+            "InstrumentationKey=00000000-0000-0000-0000-000000000000"
+        ),
+    )
+    with (
+        patch("cas_reference_product.telemetry.build_credential") as credential,
+        patch("azure.monitor.opentelemetry.configure_azure_monitor") as configure,
+    ):
+        configure_telemetry(settings)
+
+    credential.assert_called_once_with("prod")
+    configure.assert_called_once_with(
+        connection_string=settings.applicationinsights_connection_string,
+        credential=credential.return_value,
+        disable_offline_storage=True,
+        instrumentation_options={
+            "azure_sdk": {"enabled": False},
+            "requests": {"enabled": False},
+            "urllib": {"enabled": False},
+            "urllib3": {"enabled": False},
+        },
+        service_name=settings.app_name,
+    )
 
 
 def test_invalid_span_preserves_incoming_traceparent() -> None: