Microsoft Agent Framework for Python 1.23

Apply to the Python 1.23 API scope and the optional integrations used by the application, after the Python 3 baseline. When using MCP transports or hosting, also apply the MCP SDK for Python 2 prompt. Treat beta and experimental packages and APIs (including A2A, shell tools, DevUI, FIDES, and declarative agents) as separately reviewed capabilities, not as stable merely because Core is stable.

Prompt injection and tool authorization

• Keep Agent.instructions and system/developer Message content application-controlled. Treat user input, retrieved documents, memory, skills, MCP descriptions, tool results, and other agents' responses as untrusted data for prompt injection; none grants permission or changes the caller's authority.
• Enforce tool authorization inside each protected tool or mandatory function middleware, checking the authenticated principal, operation, validated arguments, and resource immediately before side effects. Tool schemas, model-selected names, tool_choice, and approval flags are not access checks.
• Fail closed in policy middleware: do not call call_next after denial, and raise MiddlewareFailure when a violation must abort the whole run. Ordinary function-middleware exceptions become tool-error results and can let the loop continue; MiddlewareTermination is early-termination control flow, not an authorization decision. Cancellation cannot undo a synchronous sibling tool already performing side effects. Apply per-model-call checks in ChatMiddleware and per-tool checks at the tool boundary.
• Register only needed tools. Review