Microsoft detailed the contract this week on its Command Line publication, while its Agent Framework documentation describes the Python implementation as a first-class but experimental capability. The open AGENT-HOOKS-0.1 specification supplies eight interception points and three decisions—allow, deny, and transform—with a conformance test kit intended to make a host’s enforcement claims reproducible.
For developers and IT teams putting tool-using agents in front of customer data, ticketing systems, internal APIs, or financial operations, the practical benefit is straightforward: a rejected tool request is supposed to be a rejection at the execution point, not a best-effort callback that somebody hopes the framework honors.
Microsoft Agent Framework has the first production-path implementation
The part that is shipping in Microsoft Agent Framework is the Python integration. Microsoft’s own Agent Hooks documentation, last updated August 25, 2026, says the feature is experimental in Python and is not yet available in the .NET or Go Agent Framework SDKs. That qualification matters because the supplied announcement describes SDKs in Python, TypeScript, .NET, Rust, and Go, which can easily be read as five production-ready framework integrations.
They are not the same thing. The Agent Hooks repository includes language SDKs and bindings so policy authors and framework maintainers can work with the contract in those languages. But a language library does not create enforcement coverage inside a framework. At present, Microsoft documents the fully wired host implementation only for Python Agent Framework; .NET remains on the ordinary agent middleware, tool approval, and safety controls while its Agent Hooks work catches up.
The Python package confirms that this is an opt-in dependency. agent-framework-core version 1.15.0, released August 21, lists an agent-hooks extra rather than enabling the feature by default. Microsoft also deliberately excludes it from the package’s all extra, a sensible signal that this is neither a transparent security patch nor a stable platform contract administrators should silently inherit during a broad dependency update.
That also means teams need to choose it. Installing the extra is not a governance program by itself; deploying it in evaluate_only mode collects decisions without blocking or rewriting actions. Microsoft explicitly warns that such a deployment should not be represented as enforced governance.
“Deny” has to reach the tool call
The design addresses a recurring problem in agent frameworks: lifecycle callbacks often make excellent telemetry but weak enforcement points. A handler may see a proposed action, throw an exception, produce an advisory result, or run in only one execution path, while the dispatcher still proceeds.
Agent Hooks makes enforcement semantics part of the host’s obligation. At pre_tool_call, a deny is intended to prevent a framework-executed function from running. At post_tool_call, a deny discards the result before it enters the agent’s usable state. A malformed context, malformed verdict, interceptor failure, or timeout must fail closed rather than quietly becoming permission to continue.
Microsoft’s documentation makes the operational result clear: model- and run-level denials raise an InterceptionBlocked failure, while a tool-level policy denial prevents that individual tool action and feeds the model a control error rather than the denied payload. The agent loop may then continue and take a different path. A failure inside the enforcement layer itself terminates the run under the Microsoft Agent Framework conformance claim.
This behavior is why Agent Hooks belongs below an ordinary application callback. Agent Framework already supports agent, function, and chat middleware, including order-dependent chains in which each component calls the next. That is flexible, but it does not on its own define what happens if a policy component crashes, transforms a value unsuccessfully, or encounters an action the application persisted before checking.
Microsoft’s Agent Hooks bundle coordinates the agent, chat, and function seams together. The framework says the pieces cannot be separately installed, reducing the chance that an application protects final output while leaving model calls or tool execution outside the boundary. It is a meaningful improvement over copying a guardrail into several custom middleware locations and assuming every retry, nested run, and persistence path behaves identically.
The audit and approval model solves a real replay problem
The contract’s strongest technical idea is not the interceptor interface. It is the treatment of approvals as content-bound decisions.
A policy can return a denial that includes an approval block. The approval is tied to a context_identity, derived from the canonical representation of the action shown to the approver. A resolution must return that same identity. If a support agent receives approval to issue an $840 refund, the approval cannot simply be replayed for a later request changing the amount to $8,400.
That distinction prevents a common implementation error: treating “the user approved this session” as though it means “the user approved every later tool call in this session.” It does not eliminate the need for identity, access-control, and approval-workflow design, but it puts the binding requirement in the protocol instead of leaving every framework adapter to invent it.
Agent Hooks also produces payload-free interception records containing decisions, reasons, sequence information, identities, and an interceptor summary. The records are intentionally not a prompt archive. That is useful for organizations that need to demonstrate that a control ran without exporting the customer data, tool arguments, or model response that control evaluated.
There is a limit administrators should take seriously: payload-free records do not mean policy code lacks access to payloads. Interceptors run in-process and receive the data they need to decide. Microsoft’s documentation and the project’s security policy both say only trusted interceptors should be registered. Installing an interceptor effectively gives it the ability to deny or transform the actions covered by the host.
Fail-closed output means accepting delayed streaming
Agent Hooks gives up something to make its output promise credible. In its default mode, Agent Framework buffers model output until the complete response has passed the relevant post_model_call and output checks. If the output is denied, the caller receives no partial tokens.
For a customer-facing chat experience, that changes perceived responsiveness. A token-by-token stream can make an application feel fast even when final completion takes time; a buffer delivers nothing until the policy check completes. Microsoft correctly frames this as a tradeoff, not a free safety upgrade. You cannot promise that confidential text will never reach the caller before enforcement while simultaneously sending it token by token before the final verdict.
The project’s specification allows hosts to declare an incremental streaming mode with a bounded exposure policy. But that declaration is a weaker assurance than fully buffered output, because content already sent cannot be retracted. Administrators should treat any “streaming with enforcement” statement as incomplete unless it specifies whether output is fully buffered, incrementally mediated, or merely checked after egress.
Persistence has a similar timing issue. Microsoft says normal after-run history waits for the final output verdict. But if an application enables per-service-call history persistence, each model exchange can become durable after its post_model_call decision. An output-only egress rule can still block the final reply while earlier model content remains in history.
For workloads where model output itself is sensitive, policy needs to run at post_model_call, not solely at final output. That is the kind of boundary detail that gets lost when governance is presented as a single “guardrail” switch.
Conformance is valuable, but it is not certification
The Agent Hooks conformance kit is the project’s most credible answer to framework-specific ambiguity. Its claims file says a conformant host must pass every test vector applicable to the capabilities it declares. The current Microsoft Agent Framework Python claim reports 47 passing vectors and four capability-gated skips, for 100 percent of its declared surface; the skips relate to undeclared incremental-output behavior.
That is more precise than the announcement’s shorthand claim of “47 of 47.” The current kit contains 51 vectors in the cited Microsoft claim, and four are not applicable because the implementation does not claim incremental streaming support. The difference is not a failure, but it illustrates why readers should inspect the declared surface rather than rely on a headline pass count.
Conformance also does not prove complete mediation in a production deployment. The project’s own security material is unusually direct: Agent Hooks is a cooperative contract, not a sandbox, reference monitor, or security certification. A hostile or buggy host can skip an interception point, ignore a verdict, execute code outside the guarded pipeline, or expose direct tool paths that the contract never sees.
Hosted tools are an especially important limitation. When a model provider runs a server-side code interpreter or managed tool, Agent Framework cannot stop it at the local pre_tool_call seam because the execution has already happened remotely. Microsoft says those calls and results appear at post_model_call; they can be inspected and influence what follows, but they are not pre-execution controls over the provider’s server-side action.
The immediate takeaway is disciplined rather than glamorous: use Agent Hooks for Python Agent Framework agents where you need a testable enforcement boundary across model calls, framework-executed tools, persistence, and final output. Keep the bundle outermost in the middleware stack, deploy in evaluate_only before blocking production actions, and test the actual tools and hosting modes your application uses.
For .NET teams, the contract is worth watching, but the documented Agent Framework capability is still Python-only as of August 27, 2026. The promise of a framework-neutral governance contract will be earned when independently maintained frameworks publish comparable conformance reports—not when they merely expose another callback.
