Microsoft Agent Framework for .NET 1.19

Apply the C# 14 baseline first and target .NET 10. These rules cover Microsoft Agent Framework for .NET 1.19 agents, chat clients, tools, workflows, state, approvals, middleware, telemetry, hosting, and operations.

Agent and chat-client construction

• Leave ChatClientAgentOptions.AllowConcurrentInvocation=false unless the agent, session provider, middleware, and every tool are concurrency-safe; this setting is independent of ChatOptions.AllowMultipleToolCalls.
• Do not set UseProvidedChatClientAsIs=true unless the supplied IChatClient already has every required decorator, because that switch removes the framework’s automatic function-invocation and safety decorators.
• If using UseProvidedChatClientAsIs, construct and test FunctionInvokingChatClient explicitly; AllowConcurrentInvocation on the agent options has no effect on a client supplied as-is.
• Bound model turns, output tokens, wall time, retries, concurrent invocations, handoffs, and aggregate tool cost in trusted configuration; a workflow edge or model finish reason is not a resource limit.
• Treat all message text, citations, structured responses, and tool-call arguments as untrusted data and validate them again for the destination operation.

Tools and approval binding

• Register AIFunction instances from a fixed trusted set, give them narrow schemas, wrap high-risk functions in ApprovalRequiredAIFunction, and reauthorize each invocation against the current principal, tenant, resource, arguments, and workflow state.
• Keep approval-response binding enabled by leaving