On August 6, microsoft/agent-framework added experimental Agent Hooks middleware and a run-persistence gate in a public commit. That is concrete source work on a problem a visible deny alone does not solve: a later turn can still read rejected material if it has already entered session history.
In an August 6 public commit, microsoft/agent-framework added an experimental implementation of AGENT-HOOKS-0.1. Its consequential move is not the label. It is a persistence gate: a denied or transformed response is handled before the relevant history write is allowed to become durable.
The microsoft/agent-framework adapter spans three places where agent work can escape a tidy story: the agent’s own run, the model call, and the function or tool invocation.
The implementation packages those pieces as one bundle, rather than letting a host install a reassuring-looking half of the control surface. It also makes an enforcement-layer failure a denial instead of quietly continuing. That is the difference between an observation hook and a mechanism that can change what happens.
The verdict has to beat the write
The hard case is streaming. Once partial text has been sent to a reader or written into a transcript, a later policy decision cannot make it unseen. Microsoft’s adapter therefore buffers a stream, applies the model and output verdicts to the completed result, and only then releases updates. That costs immediacy; it is the price of saying a denial means no partial answer escaped first.
The same ordering reaches into memory. The new run-persistence gate holds back per-call and end-of-run history until the verdict that covers it permits the content. The accompanying tests cover a denied stream that releases no updates, denied output that leaves no durable history, transformed output that persists in its transformed form, and a retry that does not leak its later attempt around the gate.
There is a useful restraint here: a fully permitted nested agent run is not casually erased just because an outer run is later denied. A control plane that destroys good work along with bad output would create a different kind of operational lie.
A hook is not a security certificate
The first angle was too generous: this is not proof that a common agent-control standard has arrived, or that every tool call is now contained. The Agent Hooks project calls its contract a draft cooperative control contract, not a security boundary or conformance certificate.
Microsoft’s implementation also names a live perimeter: tools executed by a model provider do not pass through the framework’s direct function-invocation seam, though their response can still be handled at the model-response boundary.
That caveat makes the implementation more interesting, not less. Anyone building an agent control layer should test two things separately: whether a deny stops the user-visible result, and whether it also prevents the rejected material from becoming tomorrow’s context.
The next public signal to watch is a released integration or conformance result that makes the provider-hosted-tool boundary concrete. Until then, the durable-memory test is a better question than a green “guardrails enabled” badge.