Boundaries for approvals and execution
Microsoft released Agent Framework python-1.22.0 with targeted changes to reinforce operational safety during task execution. In the AG-UI package, the framework enforces fail-closed boundaries on incoming requests and links workflow continuations and execution interrupts directly to the resolved thread identity. These adjustments prevent detached client interactions from intercepting active workflow state.
The release also restricts client state tampering around tool execution. Neither client Shared State nor saved Thread Snapshots can overwrite tool-approval states, an isolation rule that remains active even when AG-UI wraps external agents whose internal middleware is inaccessible. In declarative workflows, runtime memory protection now applies configurable limits to incoming HTTP responses and decompression phases.
State serialization and upgrade requirements
The 1.22 update alters persisted artifacts, including message logs, session history, and workflow checkpoints storing serialized records. While the new runtime remains backwards-compatible with older data stores, pre-1.22 workers cannot process records containing newer fields such as hosted or merge_mode configurations.
Because of this incompatibility, Microsoft notes that teams cannot run mixed worker versions against the same data store during rolling updates or roll back systems after new records have been saved without isolating data. Teams must also verify Python 3.15 readiness across individual packages before upgrading, as some dependencies currently restrict full adoption.
Runtime orchestration and provider adjustments
Core orchestration components receive several functional updates. The core runtime unifies streaming and protocol metadata across model providers, strips pending state after failed or interrupted workflow executions, and purges tool argument values from telemetry streams to prevent accidental credential disclosure. In addition, integrations with Foundry now deliver OAuth authorization prompts within standard non-streaming responses.
Our assessment
Teams maintaining automated deployments must examine their rollouts carefully before applying this release. Because older worker instances fail to read the new serialized format, standard blue-green or canary migrations require separate database instances or strict maintenance windows rather than concurrent reads. Security engineers should evaluate AG-UI integration points to confirm that tool approval persistence matches the new thread-binding constraints, especially when coordinating confirmation steps across distributed sessions.
Source: Microsoft original publication.
Read the original material
Microsoft (opens in a new tab)The article date belongs to Agentic Horizon. The source publication date is listed separately. Vendor claims remain attributed; we have not independently tested the reported capability.
