Microsoft Agent Framework for .NET 1.20

Apply the C# 14 prompt first on the .NET 10 baseline. These rules cover the stable Microsoft.Agents.AI 1.20.0 line and its corresponding prerelease integrations, including chat-client agents, tools and approval, sessions and memory, hosted endpoints, workflows, Agent Skills, shell and CodeAct execution, and telemetry.

Agent construction and trust boundaries

• Treat system instructions, user messages, retrieved memories, remote agent output, tool results, skill files, and model-generated arguments as distinct trust domains; label their provenance and never let lower-trust content redefine policy, identity, approval, or tool availability.
• Register agents, instructions, tools, model endpoints, middleware, hooks, memory providers, and serializers from trusted server configuration; do not select them from prompt content or untrusted request fields.
• Give every agent the smallest tool set needed for the current authenticated task and use separate agents, credentials, sessions, and stores where trust or privilege differs.
• Keep ChatClientAgentOptions.UseProvidedChatClientAsIs false unless the complete custom IChatClient pipeline has been reviewed; setting it true omits the framework's automatic function-invocation and safety-related decorators.
• When building a custom client pipeline, reproduce required decorators explicitly, preserve their documented ordering, and add regression tests for approval binding, bypass queues, message injection, history persistence, and function invocation.
• Leave concurrent function invocation disabled unless tool calls are