Microsoft Agent Framework for .NET 1.25

Apply these rules to Microsoft Agent Framework for .NET 1.25 applications composed with C# 14 and .NET 10. Apply integration-specific rules only when that integration is used; the stable core does not make preview integrations stable. When hosting through ASP.NET Core, also apply the ASP.NET Core prompt for the host's installed version.

Prompt injection and agent configuration

• Keep ChatOptions.Instructions, system-role messages, agent definitions, and tool registrations under application control. Put user text, retrieved documents, memory, and tool results in data messages; never promote them to instructions or permission to add tools.
• Review AIContextProvider and ChatHistoryProvider implementations as privileged extensions: they can supply messages and influence the model. Preserve the untrusted status of retrieved content, enforce document access before retrieval, and keep tenant filters outside model-generated search arguments. A summary or restored memory does not acquire authority by being stored.
• Construct ChatClientAgentRunOptions on the server. Do not bind client JSON directly to ChatOptions, tool collections, ChatClientFactory, or provider selection. Apply the same policy to tools added during a run and to MessageInjectingChatClient messages.

Tool authorization and approval

• Enforce tool authorization inside each AIFunction before effects occur: validate the current authenticated principal, operation, final arguments, and target resource. Obtain identity from trusted request context, not model arguments. A tool schema, discovered