#management#ai#integration

Agent Framework 1.20: Microsoft Adds Control Over Agents

Explore what Agent Framework 1.20 means for production AI agents, including flow gates, file isolation, checkpoints, and SQL Server vectors.

  • What is included in the release
  • Why pilots never reach production
  • How the new mechanisms work
  • A rule for choosing an agent platform

Trigger

  1. On October 2, Microsoft released version 1.20.0 of the Python package Agent Framework.

  2. This framework is used to build AI agents and chains of agents.

  3. The release adds almost no new model capabilities.

  4. Most changes address four questions: where agent data is stored, which files it may read, how to delay the model's response until it is checked, and which step to resume from after a failure. Companies implementing agents should take note.

  5. The layer around the model is what takes a pilot to a result, and Microsoft has started shipping it as part of the framework.

What is included in the release

- Workflow hosting in Azure AI Foundry (the `agent-framework-foundry-hosting` package).

An agent chain built in the framework can be published as a service and called through Foundry Responses and Foundry Invocations. - Built-in vector connectors for DuckDB and SQL Server and the TypeSafe AI connector. - Gates and response-stream buffering (response-stream gates). - Session-scoped file access isolation. - Typed checkpoint state for `AgentExecutor`. - Passing `FunctionInvocationContext` to skill scripts, which the developer enables explicitly.

Taken individually, these changes look minor.

Together, they address the issues that typically stall a pilot.

Why pilots never reach production

  1. The team assembles an agent demo in a week.

  2. Then security, operations, and legal teams ask their questions: - Which database receives the documents, and who backs it up? -

  3. What happens if the model sends personal data directly to a client chat? -

  4. Can one user's agent read another user's files? -

  5. A 40-step process failed at step 30.

  6. Restart and pay for the tokens again?

  7. If the team answers “we will customize it” to each of these questions, the pilot remains just a pilot.

  8. The budget is spent, the metric has not moved, and the person who proposed the project will be held accountable.

  9. Time to use (TTU) grows in such projects because of the infrastructure.

  10. The model does not answer these questions; the architecture around it does.

Assess where AI can deliver impact in your process

clients@kt.team Telegram @kt_team_it

How the new mechanisms work

### Vectors in an existing database A vector store is a database where text fragments are stored as numerical vectors.

They are used to find documents with similar meanings.

This is the foundation of RAG: the agent finds the relevant documents first and answers only afterward.

The built-in SQL Server connector keeps vectors in the same DBMS where the company already has permissions, backups, and auditing configured.

There is no need to deploy a separate cluster or obtain security approval for it.

DuckDB is suitable for local analytics and serverless prototypes. ### Response Flow Gate

The model delivers its response in chunks (streaming) so the user does not have to wait

As a result, a fragment containing a contract number or fabricated price may reach the screen before it has been checked.

The gate holds fragments in a buffer until validation approves them.

The user waits exactly as long as the check takes, but the client sees the text only after it has been controlled. ### File Isolation and Checkpoints

Session isolation restricts the agent to files from the current conversation

An agent processing one counterparty's contract cannot open another counterparty's documents.

A checkpoint is the executor's saved state, from which the process resumes after a failure. In 1.20, the state is described using `TypedDict`, a Python dictionary with declared fields and types.

Type checking catches errors in the state structure before launch.

Without it, the error will surface at night, on the thousandth document. ### Context for skills

A skill script can receive invocation data: the session and parameters.

Passing is disabled by default; the developer must enable it explicitly.

A skill knows exactly as much as it is allowed to know.

Foundry hosting is tied to Azure, limiting its applicability in the CIS environment.

The remaining mechanisms can be transferred to another stack and model, including GigaChat, YandexGPT, and Qwen in a closed environment.

A rule for choosing an agent platform

Before choosing a framework based on demo quality, ask the vendor or your team four questions:

Where are the vectors stored, and is this storage covered by the existing backup and access-control framework?

Can the model's response be stopped before the user sees it?

Which files and systems can the agent see in a given session?

From which step will the process resume after a failure?

Four specific answers indicate that the agent has a chance of reaching production. If even one answer is missing, the project will most likely stall on that point.

How we address this in projects

  1. At KT.Team, we address these requirements at the architecture level, so the solution does not depend on whether a specific framework releases the required feature. LLM & Security Gateway It sits between applications and models: masking personal data, applying response policies, and logging requests.

  2. Essentially, it is the same flow gate, shared by all the company's agents. RAG we build on databases already operating in the client's infrastructure: Elasticsearch, 1C, PIM.

  3. Agents access corporate systems through MCP with permissions tailored to a specific task.

  4. We break long processes down into events in Apache Kafka, so a failed step can be replayed without rerunning the entire chain. Take catalogs.

  5. Generating product-card text and tagging taxonomy in Akeneo or Pimcore means processing thousands of SKUs.

  6. Without checkpoints, a failure midway through a run leads to double token charges and delays the assortment launch. With checkpoints, the process resumes from the last saved position.

Conclusion

Release 1.20 shows that agent frameworks are becoming boring infrastructure, and that is good news. Businesses need an agent that can be stopped, restricted, and restarted from the required point, even if it looks modest in a demo. Teams that choose a stack based on these properties shorten the path from pilot to production. Those that choose based on an impressive demo risk launching another pilot that goes nowhere.

Discuss the article: Agent Framework 1.20: Microsoft…

Enter your email or phone number so we can get back to you.

Send via:

By clicking the button, you accept the offer and grant consent to the processing of personal data.

Related Cases

All cases

Related solutions

All solutions
AI monitoring is automatic control of processes and eventsAI assistant for Rosreestr: EGRN extracts, verification, and monitoringGEO Website Optimization for AI Search and LLMsAI Accountant in Your Environment: Implementation Cost

Articles on the topic

AI in Business Collection

Related videos

All videos
Shorts What “KPI” did Amazon set for developers in the AI era? AITeams & hiringManagement
Shorts Can't Keep Up with AI? Build Communication and Accountability AI
Shorts AI does not empower the weak! AI

News on the topic

All news