Microsoft Releases Agent Framework Version 1.0 for Building AI Agents

Microsoft officially launched Agent Framework 1.0, a production-ready platform for building and deploying AI agents that applies middleware pipeline patterns to agent architectures. The framework supports three middleware types—Agent middleware for turn-level concerns like security screening and audit logging, Function middleware for wrapping individual tool calls with validation and performance monitoring, and Chat middleware for wrapping raw LLM inference calls. Middleware executes in nested order (A1→A2→R1→R2→Agent→R2→R1→A2→A1) and can short-circuit execution by omitting call_next(), though terminating the function calling loop may leave chat history inconsistent. The framework supports both function-based and class-based implementations, with middleware registered during agent construction and automatically routed to the correct pipeline layer.

Pipeline Pattern Architecture and Middleware Types

• ▪Microsoft Agent Framework 1.0 supports both function-based and class-based implementations for all three middleware types.
• ▪In Microsoft Agent Framework 1.0, when agent middleware [A1, A2] and run middleware [R1, R2] are registered, the execution order is A1 → A2 → R1 → R2 → Agent → R2 → R1 → A2 → A1.
• ▪In Microsoft Agent Framework 1.0, middleware mutates the shared context object directly rather than passing updated values into call_next() as arguments.
• ▪Microsoft Agent Framework 1.0 applies the pipeline pattern to AI agents, where the next() delegate becomes call_next() and the context object holds the agent's conversation instead of an HTTP request.

Agent Middleware: Turn-Level Control and Security

• ▪Microsoft Agent Framework 1.0 Agent middleware is the appropriate choice for concerns that apply to the turn as a whole rather than to a specific tool call or model request.
• ▪Microsoft Agent Framework 1.0 supports decorator-based Agent middleware implementation using the @agent_middleware decorator.
• ▪Microsoft Agent Framework 1.0 Agent middleware fires once per turn before any LLM call is made and after the final reply or response is produced.
• ▪In Microsoft Agent Framework 1.0, omitting the call_next() call in Agent middleware short-circuits the pipeline and prevents any downstream middleware or the LLM from running.
• ▪Microsoft Agent Framework 1.0 Agent middleware is the appropriate layer for input validation, security screening, audit logging, and output transformation.

Function Middleware: Tool-Call Interception and Execution Control

• ▪Microsoft Agent Framework 1.0 Function middleware fires inside the agent turn only when the LLM decides to invoke a tool.
• ▪In Microsoft Agent Framework 1.0, terminating the function calling loop can leave the chat history in an inconsistent state with a tool-call message that has no corresponding tool result, which may cause errors in subsequent agent runs.
• ▪Microsoft Agent Framework 1.0 Function middleware is appropriate for execution timing and performance monitoring, validating or sanitizing tool arguments, capping the number of times a tool may be called in one turn, transforming tool results, and auditing tool calls.
• ▪In Microsoft Agent Framework 1.0, a single agent turn can trigger multiple tool calls, and Function middleware wraps each one independently.

Chat Middleware and Registration Mechanisms

• ▪Microsoft Agent Framework 1.0 allows different middleware types to be mixed in the same list during registration, and the framework routes each to the correct pipeline layer automatically.
• ▪In Microsoft Agent Framework 1.0, middleware is registered when constructing the agent by passing a list to the middleware argument.
• ▪Microsoft Agent Framework 1.0 Chat middleware fires for every call to the LLM within a turn.

Perspective of Enterprise developers building production AI agents

• ▪Microsoft Agent Framework 1.0's support for both function-based and class-based middleware implementations allows enterprise developers to choose patterns that match their existing codebases.
• ▪Microsoft Agent Framework 1.0 provides enterprise developers with production-ready middleware patterns for implementing security screening and audit logging requirements.

Perspective of AI safety and security practitioners

• ▪Microsoft Agent Framework 1.0's Agent middleware layer provides security practitioners with a centralized interception point for screening both user inputs and AI-generated outputs before execution.
• ▪Microsoft Agent Framework 1.0's Function middleware enables security practitioners to validate and sanitize tool arguments before potentially dangerous functions execute.

2 sources