Agent Framework pending approval and session binding
Can an Agent Framework approval response authorise a call absent from the current session?
For the documented Python default, approval must match a pending request in the same AgentSession. Unbound responses are ignored with a warning. Disabling approval-response binding restores unbound behaviour and requires equivalent application-side validation.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse an authorised-call finding without the matching pending request, session and effective binding configuration; a supplied approval message alone is insufficient.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Agent Framework changed arguments after approval
Does an Agent Framework approval remain valid after middleware changes the tool arguments?
The Python guidance requires replacement approval for changed values only when JSON serialization and revalidation preserve those values exactly. Otherwise invocation fails with MiddlewareFailure; the earlier approval is not reused.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse approval continuity when executed arguments differ from reviewed arguments or exact revalidation cannot be demonstrated.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Agent Framework standing approvals across tool replacement
Can a replacement Agent Framework tool inherit a saved approval through its name?
The Python harness stores standing approvals in AgentSession, not on a particular agent or tool instance. A replacement with the same name, including an MCP tool, can match a saved tool-wide or argument-specific rule.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse unchanged-authority conclusions after agent or tool replacement until saved rules and the current tool identity are reviewed; start a new session when approval must not carry forward.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Agent Framework automatic approval switch boundary
Does disabling Agent Framework harness auto-approval remove a tool approval requirement?
In the documented Python harness, disable_tool_auto_approval removes its approval middleware but does not change the tool approval_mode. The ordinary user_input_requests flow still applies to approval-required tools.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse a no-approval-needed finding based only on the harness switch; inspect tool requirements and the host approval-response flow separately.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Agent Framework autonomous loop approval interruption
Can an Agent Framework autonomous loop treat a pending tool approval as another iteration?
The Python AgentLoopMiddleware returns pending approval requests before evaluating its continuation predicate. It does not install approval handling itself. The host must resolve approval through the normal flow before continuing.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse task-completion or permission findings from a loop return alone; distinguish pending approval from satisfied completion and preserve the associated session.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Agent Framework checkpoint deserialization trust
Does Agent Framework restricted checkpoint deserialization make an untrusted checkpoint safe?
Microsoft treats checkpoint storage as trusted private infrastructure. Restricted unpickling and allowed types do not make untrusted pickle data safe; permitted classes can carry reconstruction behaviour.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse to treat a foreign or tampered checkpoint as safe solely because its types are allowed; require trusted provenance and protected storage.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Agent Framework checkpoint type-registration scope
Does registering an Agent Framework checkpoint type affect only the current storage instance?
register_checkpoint_type expands decoding permissions across the Python process, including existing storage instances. allowed_checkpoint_types instead applies to its receiving store or provider. Both extend the restricted deserializer.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse a store-local change assessment for global registration; inventory every decoder affected and require justification for each trusted additional type.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Agent Framework checkpoint listing completeness
Does Agent Framework get_latest prove it considered every checkpoint file on disk?
FileCheckpointStorage listings and get_latest skip malformed or undecodable files using the decoding path. Its save operation also refuses data that the same configured instance cannot restore.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse a complete-checkpoint-inventory or newest-written-state finding from the returned list alone; reconcile file inventory and decoding failures.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Agent Framework missing checkpoint session defaults
Does a successful Agent Framework checkpoint restore prove the original agent session was preserved?
AgentExecutorCheckpointState defaults missing known fields, creating a new agent session when agent_session is absent. Unknown fields are ignored; malformed known fields raise WorkflowCheckpointException.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse original-session continuity based only on successful decoding; inspect required saved fields and restored identity, including defaults and ignored fields.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Agent Framework checkpoint identity across redeployment
Can rebuilding a .NET Agent Framework workflow with new agent IDs resume its old checkpoints?
The .NET resume contract requires the same workflow structure and executor identities. Agent IDs and configured names must stay stable. Assigning stable values later does not repair old checkpoints created with different identities.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse compatible-resume claims across redeployment without matching structure, IDs and names; retain or explicitly replace the old checkpoint lineage.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
Agent Framework checkpoint provider durability
Does using an Agent Framework checkpoint provider imply cross-process recovery?
The documented Python providers have different durability: InMemoryCheckpointStorage is process-local, FileCheckpointStorage uses local disk, and CosmosCheckpointStorage supports distributed persistence. A shared interface does not equal shared durability.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse restart or cross-instance recovery guarantees without the actual backend, storage lifecycle and recovery evidence; an in-memory checkpoint is insufficient.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AG-UI finished event and pending workflow interrupt
Does an Agent Framework AG-UI RUN_FINISHED event prove the workflow completed its task?
The Python workflow adapter emits RUN_FINISHED with outcome.type set to interrupt when awaiting input. The event can contain pending interrupt details rather than a completed business outcome.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse a completed-action finding from the event name alone; inspect the outcome and pending requests and reconcile any downstream action result.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AG-UI continuation thread identity
Can an Agent Framework AG-UI continuation omit the thread ID returned at the start?
When the initial threadId is absent, the endpoint reports a generated ID in RUN_STARTED. Continuations use that ID. With workflow_factory, resume, tool-result or approval continuation without threadId fails before creating a new workflow.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse continuity based on request order or identical text; bind continuation to the reported thread identity and retain failure evidence.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AG-UI checkpoint ownership and legacy resume
Does an Agent Framework checkpoint ID alone authorise AG-UI resume?
New checkpoints are bound to Snapshot Scope and threadId. Mismatches fail closed. Older ownerless checkpoints cannot resume through scoped or threaded requests; legacy unscoped, unthreaded resumes remain supported. Endpoint authorization remains separate.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse ownership or access approval from possession of a checkpoint ID; establish endpoint authorization, scope/thread binding and legacy-path handling.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AG-UI visible snapshot versus execution checkpoint
Can restoring an AG-UI thread snapshot resume the Agent Framework executor state?
Workflow checkpoints preserve executor/runtime state and pending requests. AG-UI snapshots preserve replayable client output, shared state and the latest interrupt. Neither persistence mechanism substitutes for the other.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse executable-recovery claims from a restored conversation display; reconcile the runtime checkpoint separately from the client-visible snapshot.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AG-UI shared workflow instance versus thread factory
Does supplying one workflow instance to Agent Framework AG-UI create isolated state for every thread?
The Python adapter accepts either a direct workflow or workflow_factory. Documentation reserves a direct instance for safely shared workflows and recommends a factory when each thread requires its own workflow state.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse per-thread isolation claims from the endpoint wrapper alone; inspect shared mutable state and factory construction, alongside authorization controls.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
AG-UI .NET and Python lifecycle capability boundary
Does exposing a .NET Agent Framework workflow through AG-UI provide the Python workflow interrupt and resume mapping?
The captured .NET guidance exposes constituent-agent text and tool output but does not map workflow step events, activity snapshots, interrupts or Python-equivalent resume operations. Wrapping as AIAgent does not add them.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse cross-language lifecycle parity based on the shared AG-UI name; require supported events and continuation operations for the installed implementation.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
ADK confirmation session-backend support
Does ADK tool confirmation support every persistent session backend?
The captured experimental confirmation guide explicitly excludes DatabaseSessionService and VertexAiSessionService. Support for those services elsewhere in ADK does not establish support for this confirmation feature.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse a supported durable-approval design without confirmation/backend compatibility for the deployed version; do not infer compatibility from general session support.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
ADK confirmation call and invocation continuity
Which identities must an ADK REST confirmation preserve when resuming a workflow?
The response must use the confirmation call ID and adk_request_confirmation name, with confirmed status and optional payload. Resumable workflows also require the originating invocation_id; a different invocation ID starts a new invocation.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse original-run approval continuity without matching call, session and invocation context plus an authorised decision; structured payload alone does not establish permission.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
ADK session token custody and authenticated user binding
Does an ADK session backend automatically provide appropriate custody for refresh tokens?
ADK warns against assuming safe credential custody from session state. For self-managed interactive authentication it recommends user-bound encrypted storage; long-lived secrets belong in dedicated management rather than ordinary session memory.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse a protected-token finding from SessionService selection alone; inspect credential location, authenticated-user binding, encryption and access controls.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
ADK service ID-token target and lifetime boundary
Can an ADK service-account ID token be reused as a general Google API access token?
ADK distinguishes audience-bound ID tokens for IAM-secured services from scoped access tokens for Google APIs. The documented ID-token path fetches at request time rather than refreshing on a background timer.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse cross-service authority or unattended-refresh assumptions without the correct token type, target audience, IAM permission and issuance evidence.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review
ADK authentication response and original tool retry
Does completing ADK OAuth only save credentials without restarting the blocked tool call?
The documented interactive flow exchanges the returned authorization information, stores obtained tokens in session state and automatically retries the original tool call. Authentication completion and business-action completion remain separate observations.
Documentation reviewed 2026-10-31. Primary source.
Boundaries
- Refuse a credentials-only or completed-business-action finding from the auth callback alone; reconcile the retried tool identity and result and guard side effects separately.
- Buyer implementation, live runtime enforcement, settled payment, verified deletion or certification are not established.
- No expanded capabilities or licences for existing INDEX executables.
Complete record JSON · Exact free preview JSON · Source review