Agent Framework 1.21: Control Built into the Agent Loop

What is included in the release

Microsoft released python-1.21.0 for Agent Framework. The model itself has not become smarter in this release. However, it now includes policy checks on streaming responses, rules for tool results, visibility into substituted arguments, and an explicitly selectable maximum-effort reasoning mode.

With these controls, the IT director can answer the question, “What did the agent do, and why was it allowed to do it?”

An agent that cannot be verified will not enter production, no matter how capable it is.

In this release: - `agent-framework-core` and `agent-framework-purview` add standing guidance for tool results, disclosure of rewritten arguments during variable substitution, and full-buffer Purview policy evaluation for streaming responses (PRs #8784, #8506, #8702); - `agent-framework-openai` adds a maximum-effort reasoning mode (#8857); - `agent-framework-oracle` adds an Oracle vector store connector marked alpha (#8676); - in the examples

the examples show response filtering in group chats and an expanded get-started sequence (#9005, #9133).

Only the maximum-effort reasoning mode affects the quality of the model's response. The other items determine who checks the response, where, and according to which rules.

Streaming responses and policy: where checks break down

Streaming output lets users see text immediately instead of waiting for the complete response. Checking policies on such a stream—such as personal-data leaks, prohibited topics, and corporate restrictions—runs into a simple problem: it is difficult to reach a verdict from a fragment of a phrase.
A card number split into two pieces is not recognized in either piece. “Full-buffer evaluation”
For Purview, this means that the policy examines the entire response.
The release notes do not show exactly how it addresses the trade-off.
My hypothesis is that either the text is held back until a verdict is reached, or the check runs in parallel and can retract content that has already been shown. Both options have a cost, which must be measured against your own scenarios before launch.
For the customer, this means that saying “we have DLP” says nothing about the agent until it is clear which segment of the stream it covers.

Tool output as model input

The agent calls a tool: it searches the knowledge base, reads an email, or accesses ERP. The result returned by the tool goes back to the model as text.
If an instruction is hidden in an email or document, the model may mistake it for an instruction to follow.
This is a classic data injection, and it occurs in the most innocuous part of the loop.
The standing guidance for tool results added in 1.21.0 appears, judging by its name, to give the framework a persistent rule for handling such results.
The release notes do not disclose implementation details, so it is too early to assess its strength.
The direction is right: the rule for processing tool data is defined once at the platform level, keeping agent prompts shorter.
The second related item is disclosure of rewritten arguments during variable substitution.
If a call parameter is assembled from variables, the log must retain the arguments that were actually sent to the tool.
A template is useless for an investigation. For an incident, the difference is this: “the agent requested a report”
or “the agent requested a report about a customer it should not have been able to see.”

Maximum reasoning effort as a budget item

The OpenAI connector now includes a maximum-effort reasoning mode.

More reasoning usually takes longer and costs more tokens.

The release provides no specific figures, and I will not substitute figures from elsewhere.

The rule that works in our projects is to choose reasoning effort by task and assign it permanently to that task.

Classifying incoming requests and analyzing a disputed contract require different budgets.

If maximum effort is enabled for every task, costs will rise and response times will exceed the limits that keep the process convenient.

If it is enabled nowhere, the most costly errors will remain in the most complex cases. TTU, or time to outcome, is measured separately for each task type.

Assess where AI can deliver impact in your process

clients@kt.team Telegram @kt_team_it

Oracle and the alpha boundary

The Oracle vector store connector is marked alpha. For an enterprise customer, this is a signal in both directions. It is good that the framework goes to data where it already resides: in many companies, the core system of record runs on Oracle, and moving a copy to a separate vector store means adding another system with its own access permissions. The downside is that alpha means there are no guarantees regarding the API or behavior. For RAG on such data, it is sensible to build a pilot and postpone production use until the connector stabilizes.

What leaders should take away

Before moving an agent from pilot to production, ask the team three questions:
Where in the agent loop is the output checked, and over what amount of text: a stream fragment or the complete response?
What is recorded in the log: the tool-call template or the arguments that were actually sent?
Who decides how much reasoning effort to pay for each task, and according to what rule? If the answer to any of these questions is “we will see how it goes,” you have a demonstration, not a production system. You need the answers before the first day of working with real customer data.

Where this is handled technically

Microsoft’s framework provides integration points, but it will not define your company’s policy for you. In our practice, a unified layer between agents and models (LLM & Security Gateway) centralizes checks, logs, and limits.
Tools are available to agents through MCP with restricted permissions, while control resides in this layer instead of being scattered across a dozen prompts.
This layer lets you change the model or framework without rewriting the rules: today it is Agent Framework on Python; tomorrow, a different library.
The user sees a chat, while beneath it runs a chain of checks that someone must design and maintain.
A simple interface requires complex engineering.

Verdict

Release 1.21.0 shows where agent platforms are heading: Microsoft is investing in making the loop verifiable. In my view, the reason is access to real data: an agent that has not passed security checks will never reach meaningful metrics and remains an expensive experiment. Choose a platform based on what it enables you to prove to an auditor.

Source

Release python-1.21.0, repository microsoft/agent-framework, author: Microsoft. The license terms are specified in the repository: https://github.com/microsoft/agent-framework/releases/tag/python-1.21.0