Implement an Org Propagation Guard mechanism by amarziali · Pull Request #11289 · DataDog/dd-trace-java

amarziali · 2026-05-06T13:27:42Z

What Does This Do

Adds the Org Propagation Guard (OPG): a propagation-layer check that prevents the part of the tracing context from leaking across organizational boundaries.

When enabled, every inbound trace is checked against the local Org Propagation Marker (OPM) reported by the Datadog Agent. If the inbound OPM doesn't match (or is absent in strict mode), sampling priority, origin, and _dd.p.* propagation tags are dropped. Parent/trace IDs, W3C baggage, and non-dd vendor tracestate are kept. On the inject side, the local OPM is stamped onto outgoing requests so downstream services can do the same check.

Off by default, with no overhead when disabled. When the agent hasn't reported a local OPM yet, enforcement is skipped entirely and the inbound context passes through unchanged, including any inbound OPM it carries.

Two additional knobs:

DD_TRACE_ORG_GUARD_STRICT=true also enforces when the inbound OPM is absent (not just on mismatch)
DD_TRACE_ORG_GUARD_TRUSTED_OPMS accepts a comma-separated list of partner OPMs to allow through

Each enforcement emits an org_guard.enforce metric with a reason tag (mismatch or strict_missing).

New configuration

Env var	Default	Description
`DD_TRACE_ORG_GUARD_ENABLED`	`false`	Master switch
`DD_TRACE_ORG_GUARD_STRICT`	`false`	Enforce when inbound OPM is absent too
`DD_TRACE_ORG_GUARD_TRUSTED_OPMS`	(empty)	Comma-separated allowlist of trusted inbound OPMs

Motivation

Additional Notes

System tests: DataDog/system-tests#6872

Contributor Checklist

Format the title according to the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any other useful labels
Avoid using close, fix, or any linking keywords when referencing an issue
Use solves instead, and assign the PR milestone to the issue
Update the CODEOWNERS file on source file addition, migration, or deletion
Update public documentation with any new configuration flags or behaviors

Jira ticket: [PROJ-IDENT]

Note: Once your PR is ready to merge, add it to the merge queue by commenting /merge. /merge -c cancels the queue request. /merge -f --reason "reason" skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.

datadog-prod-us1-5 · 2026-05-26T09:48:13Z

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 5 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-java | java-startup-parallel-check-slo-breaches

See error
Failed to retrieve GitHub token due to missing file 'artifacts/fail-on-breach.github-token'. No Markdown threshold comparison report generated.

DataDog/apm-reliability/dd-trace-java | java-startup-parallel-generate-slos

See error
Script execution failed. No artifacts found in working directory or CI project directory.

DataDog/apm-reliability/dd-trace-java | java-startup-parallel-upload-to-bp-api

See error
File check failed: cannot access '/go/src/github.com/DataDog/apm-reliability/dd-trace-java/artifacts/candidate-*.converted.json'

View all 5 failed jobs.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 696dadc | Docs | Datadog PR Page | Give us feedback!}

dd-octo-sts · 2026-05-26T09:59:18Z

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Startup Time

Scenario	This PR	master	Change
insecure-bank / iast	13,995 ms	13,870 ms	+0.9%
insecure-bank / tracing	12,852 ms	12,951 ms	-0.8%
petclinic / appsec	16,519 ms	16,478 ms	+0.2%
petclinic / iast	16,598 ms	16,606 ms	-0.0%
petclinic / profiling	16,356 ms	16,545 ms	-1.1%
petclinic / tracing	15,892 ms	15,793 ms	+0.6%

Commit: 58d4e2d8 · CI Pipeline · Benchmarking Platform UI

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

mcculls

Looks good - just some small suggestions

…/OrgGuardEnforcer.java Co-authored-by: Stuart McCulloch <stuart.mcculloch@datadoghq.com>

dd-octo-sts · 2026-06-03T09:50:05Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-06-03T09:50:09Z

View all feedbacks in Devflow UI.

2026-06-03 09:50:08 UTC ℹ️ Start processing command /merge

2026-06-03 09:50:13 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

2026-06-03 11:50:50 UTC ❌ MergeQueue: The build pipeline has timeout

The merge request has been interrupted because the build 4860038863213809884 took longer than expected. The current limit for the base branch 'master' is 120 minutes.

amarziali · 2026-06-03T12:17:40Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-06-03T12:17:44Z

View all feedbacks in Devflow UI.

2026-06-03 12:17:44 UTC ℹ️ Start processing command /merge

2026-06-03 12:17:49 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

2026-06-03 13:33:40 UTC ℹ️ MergeQueue: This merge request was merged

amarziali added type: feature Enhancements and improvements comp: context propagation Trace context propagation labels May 6, 2026

amarziali force-pushed the andrea.marziali/opg2 branch from 36a2d96 to 58d4e2d Compare May 26, 2026 09:42

amarziali force-pushed the andrea.marziali/opg2 branch from 58d4e2d to 784f890 Compare June 2, 2026 07:04

amarziali marked this pull request as ready for review June 2, 2026 07:29

amarziali requested review from a team as code owners June 2, 2026 07:29

amarziali requested review from manuel-alvarez-alvarez, mcculls, mtoffl01 and sarahchen6 and removed request for a team June 2, 2026 07:29

mcculls reviewed Jun 2, 2026

View reviewed changes

Comment thread dd-trace-core/src/main/java/datadog/trace/core/propagation/ptags/PTagsFactory.java Outdated

mcculls reviewed Jun 2, 2026

View reviewed changes

Comment thread dd-trace-core/src/main/java/datadog/trace/core/propagation/opg/OrgGuardEnforcer.java Outdated

mcculls reviewed Jun 2, 2026

View reviewed changes

Comment thread dd-trace-core/src/main/java/datadog/trace/core/propagation/opg/OrgGuardEnforcer.java Outdated

mcculls approved these changes Jun 2, 2026

View reviewed changes

amarziali and others added 6 commits June 3, 2026 09:18

Implement an Org Propagation Guard mechanism

948663a

remove tech debt

878e869

Add static imports

6fc44aa

Humain assisted improvements

fd63804

Update dd-trace-core/src/main/java/datadog/trace/core/propagation/opg…

57c1af3

…/OrgGuardEnforcer.java Co-authored-by: Stuart McCulloch <stuart.mcculloch@datadoghq.com>

suggestions

dc033e7

amarziali force-pushed the andrea.marziali/opg2 branch from 64ce55d to 92cf0c6 Compare June 3, 2026 07:19

amarziali enabled auto-merge June 3, 2026 07:20

change list to array in config json

696dadc

amarziali force-pushed the andrea.marziali/opg2 branch from 92cf0c6 to 696dadc Compare June 3, 2026 08:18

amarziali added this pull request to the merge queue Jun 3, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jun 3, 2026

gh-worker-dd-mergequeue-cf854d Bot merged commit da34f3a into master Jun 3, 2026
756 of 760 checks passed

gh-worker-dd-mergequeue-cf854d Bot deleted the andrea.marziali/opg2 branch June 3, 2026 13:33

github-actions Bot added this to the 1.64.0 milestone Jun 3, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Implement an Org Propagation Guard mechanism#11289

Implement an Org Propagation Guard mechanism#11289
gh-worker-dd-mergequeue-cf854d[bot] merged 7 commits into
masterfrom
andrea.marziali/opg2

amarziali commented May 6, 2026 •

edited

Loading

Uh oh!

datadog-prod-us1-5 Bot commented May 26, 2026 •

edited by datadog-official Bot

Loading

Uh oh!

dd-octo-sts Bot commented May 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mcculls left a comment

Uh oh!

dd-octo-sts Bot commented Jun 3, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

amarziali commented Jun 3, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

amarziali commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

New configuration

Motivation

Additional Notes

Contributor Checklist

Uh oh!

datadog-prod-us1-5 Bot commented May 26, 2026 • edited by datadog-official Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

Uh oh!

dd-octo-sts Bot commented May 26, 2026

🟢 Java Benchmark SLOs — All performance SLOs passed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mcculls left a comment

Choose a reason for hiding this comment

Uh oh!

dd-octo-sts Bot commented Jun 3, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

amarziali commented Jun 3, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

amarziali commented May 6, 2026 •

edited

Loading

datadog-prod-us1-5 Bot commented May 26, 2026 •

edited by datadog-official Bot

Loading

gh-worker-devflow-routing-ef8351 Bot commented Jun 3, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Jun 3, 2026 •

edited

Loading