ADK plugin ordering and short-circuit lab

What this experiment demonstrates

This deterministic model represents a callback chain with a policy plugin, a cache plugin, and a local observer. A non-empty substitute result ends the modeled chain. The cache fixture intentionally lacks its own current-access check, so a cache hit before policy can release data that the current principal is not allowed to receive. This is an application composition mistake, not a claim that every ADK cache behaves this way.

The backend check applies only when the tool endpoint is actually called. A cached response is a separate release path. Enabling backend authorization cannot protect data that was released without contacting that backend. The distinction is visible in the trace and the unauthorized-cache-release metric.

Compare ordering and independent enforcement

Begin with the default denied request, cache hit, and cache-first order. The cache returns a result and later hooks are skipped. Change the order to Policy first: the denial occurs before cache release. Turn the cache hit off and verify that the denied request does not execute the tool.

Now disable the policy plugin and keep the cache off. With backend authorization on, the endpoint still blocks the request. Turn backend authorization off to observe a tool execution without the required policy. This comparison separates framework enforcement from the service boundary. Restore the policy plugin and try Required policy unavailable; the fixture holds the request rather than treating an outage as permission.

How to inspect the trace

Start trace returns the visible sequence to zero steps; Next step reveals the next hook or endpoint decision. Show all and the step slider provide direct inspection. Complete-run metrics remain visible while you inspect a partial trace. They count policy checks, tool executions, and unauthorized cache releases, which are different outcomes and should not be combined into a generic safety score.

Reset restores the original cache-first failure fixture. Export JSON saves the assumptions and trace to your device. Use two exports to compare the exact control-flow difference caused by reordering a plugin or enabling the backend check.

Limits and implementation exercise

No ADK SDK, model, cache server, or real identity service runs in this page. The lifecycle is a teaching model based on documented callback concepts. Actual signatures and ordering must be verified in the pinned SDK and deployment mode. The fixture does not model every plugin hook, exception propagation, asynchronous event, or cache invalidation strategy.

In a real integration, build a runner test with two plugins and trace markers. Return a synthetic cached result from the first and assert whether the later policy callback executes. Then test current-access checks on the cache itself, tenant-aware keys, and entitlement revocation. Keep authoritative audit events at the enforcement boundary so short-circuiting cannot silently erase the decision record.