[Shivam Sharma (ShivamSharma43)]

Related Issue

None. This is a gap in RAGPolicy's validation; the sections below are filled in as the template asks.

Problem & Solution

Problem. RAGPolicy.max_retrievals_per_minute is documented as "maximum retrieval calls per agent per sliding window. 0 disables rate limiting." RateLimiter.check treats exactly 0 as unlimited and otherwise rejects a call once len(window) >= limit. A negative limit (for example -1, which many libraries use for "unlimited") passes RAGPolicy without complaint, and since the window length is never below -1, every retrieval is refused:

governor = RAGGovernor(RAGPolicy(max_retrievals_per_minute=-1))
governor.wrap(retriever).invoke("q")
# RateLimitExceededError: Agent 'default' exceeded retrieval limit of -1 per 60s

Nothing points at the configuration as the cause, and each refused call is audited as rate_limited.

Solution. RAGPolicy.__post_init__ raises ValueError for a negative max_retrievals_per_minute, next to the existing check that rate_limit_window_seconds is positive. The docstring says so. 0 still disables rate limiting, and positive limits are unchanged.

Impact on Your Work

A policy written with -1 for "no limit" blocked the whole retriever with a rate-limit error that names no misconfiguration. It now fails when the policy is built, with a message that names the field.

Timeline

None.

Alternatives Considered

• Treat any value <= 0 as "no limit". That would silently turn a typo or a sign error into unlimited retrieval. Raising keeps the choice explicit, and matches how RAGPolicy handles rate_limit_window_seconds.
• Also validate in RateLimiter.check. RAGPolicy is where a user sets the limit, and #4233 is open on rate_limiter.py's check() docstring, so this PR leaves that file alone.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Maintenance (dependency updates, CI/CD, refactoring)
• Security fix

Package(s) Affected

• agent-rag-governance

Testing

Unit Testing

In tests/test_policy.py:

• test_negative_max_retrievals_rejected (-1, -100): RAGPolicy raises ValueError naming max_retrievals_per_minute. Fails on main and passes with the fix.
• test_zero_max_retrievals_disables_rate_limiting: a policy with 0 still builds, and a RateLimiter with its window allows 500 calls in a row.

Manual Testing

• agent-rag-governance tests: 146 passed.
• ruff check on the changed files: no new findings (the existing typing.List/Optional and import-order findings in these two files are unchanged).
• Spell check on the added lines (scripts/ci/changed_lines.py + cspell@8.17.3): no issues.

Checklist

• I have linked a related issue above, or completed "Problem & Solution", "Impact on Your Work", and "Alternatives Considered"
• My code follows the project style guidelines (ruff check)
• I have added tests that prove my fix/feature works
• All new and existing tests pass (pytest)
• I have updated documentation as needed (CHANGELOG, docstring)
• I have signed the Microsoft CLA

Attribution & Prior Art

• This contribution does not contain code copied or derived from other projects without attribution
• Any external projects that inspired this design are credited in code comments or documentation
• If this PR implements functionality similar to an existing open-source project, I have listed it below

Prior art / related projects (if any):

AI Assistance

• I can explain every meaningful change in this PR: what it does, why, and what tradeoffs were considered
• I have run tests and verification appropriate for this change
• No part of this PR was autonomously submitted by an AI agent without my review
• I have not used AI to generate review comments on others' PRs

I used Claude Code (Claude Opus) to help find the bug and draft the fix and tests. I reviewed the full diff and will handle review comments myself.

IP, Patents, and Licensing

• This contribution does not implement patent-pending or patent-encumbered techniques
• This contribution does not require an NDA or licensing agreement to understand or use
• Any AI tools used have terms compatible with the MIT License

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.