[varunc12502-oss]

Addresses the discussion in #14573.

Python SK already supports function invocation filters, but there is no example of using one as a guard that blocks a tool call before it runs.

What this adds:

• samples/concepts/filtering/command_guard_filter.py: a filter factory that takes any scanner with scan(command) (sync or async) and skips the call if it is not allowed. No third-party dependency.
• 5 unit tests in tests/unit/kernel/test_command_guard_filter_sample.py.
• An entry in the concepts README.

Opening as a draft to get maintainer feedback on whether this belongs in the samples.

[varunc12502-oss]

@microsoft-github-policy-service agree