A security release that treats agent state as an authority boundary

Microsoft's Python Agent Framework 1.22 release is notable less for a new agent capability than for tightening the places where client-controlled state meets server-owned authority. The coordinated release, published October 15, changes AG-UI checkpoint ownership, approval-state handling, content identity, and persisted-record compatibility.

That is the dependable-agent story: durable state is not just memory. It can contain resumable execution, tool approvals, and routing metadata. A runtime has to know which side is allowed to write each part.

What changed

The release notes mark several changes as breaking.

First, AG-UI workflow checkpoints and continuations are bound to the resolved thread and snapshot scope. The hardening change says cold resumes now fail closed when ownership cannot be established. A related fix makes requests that omit threadId resolve it once, so the ID reported to the client is also the ID used for the workflow instance, snapshot, and live interrupt ownership.

Second, client Shared State is no longer allowed to replace server-owned tool-approval state. The follow-up patch covers wrappers that do not expose their underlying middleware: values shaped like approval state—non-empty rules, queued_approval_requests, or collected_approval_responses lists—are kept out of AgentSession.state. This closes a gap where replayed snapshot state or a fresh client value could supply or replace standing approval data read by wrapped middleware.

Third, client-provided shared state and forwarded A2UI context are treated as untrusted user data rather than system-priority instructions. Per-request A2UI injection also requires a backend opt-in. Fresh inbound media is limited to HTTP, HTTPS, data URIs, or inline bytes; other schemes and unresolved client-owned file references must be fetched and authorized by application code.

Finally, the core content model now carries explicit hosted-execution and stream-merge semantics across providers and adapters. This is a useful interoperability improvement, but it creates a deployment constraint: 1.22 can read older persisted records, while older runtimes cannot read new records containing hosted or merge_mode. The release explicitly warns against mixed old/new workers on the same affected store and against downgrading after new records have been written unless state is isolated or migrated.

What I verified

I checked out the release tag target at commit 14229b083a7ef95eeaadf472e1da0367a9f46457. The checkout identifies agent-framework-core as 1.22.0 and agent-framework-ag-ui as 1.6.0.

In an isolated Python 3.11 environment, I installed those two packages from the checkout and ran three selected AG-UI test modules covering approval-state keys, message/media adapters, and A2UI behavior. The observed result was 269 passed in 1.00 seconds.

This was a focused source-level verification, not a full framework qualification. I did not run the complete repository suite or reproduce a live cross-tenant exploit. An additional endpoint-test selection could not be collected in the sparse checkout because the orchestration package was not installed; I excluded it rather than treating it as a product failure.

Why it matters

The most important design move is the separation of transport state from authority. A client needs to send conversation state and continuation material, but that does not make every field equally trusted. Approval rules, checkpoint ownership, capability activation, and hosted-versus-local execution are control-plane facts.

For operators, the immediate work is concrete:

1. Upgrade the coordinated Python package set rather than mixing independently versioned adapters and core packages.
2. Drain or isolate older workers before 1.22 writes new content records to shared durable stores.
3. Ensure workflow clients return the threadId emitted in RUN_STARTED when continuing a run that began without one.
4. Move trusted instructions out of client Shared State and A2UI context into server-owned configuration.
5. Treat rejected custom media schemes as an authorization handoff: resolve them in application code, then pass approved content onward.

This release makes some integrations less permissive. That is the point. In agent infrastructure, compatibility should yield when it conflicts with a clear security boundary—and the migration cost should be documented as explicitly as it is here.