AG-UI.AIGENERATIVE UI INTELLIGENCE
中文Subscribe ↗
FrameworksOfficial

Microsoft Agent Framework makes AG-UI thread, approval, and authorization boundaries fail closed

Microsoft Agent Framework Python 1.22.0, released October 15, binds workflow continuations and interrupts to the resolved thread ID and prevents client Shared State or stored Thread Snapshots from replacing server-owned tool-approval state. Version 1.23.0 on October 22 then requires an explicit authorization scope or a single-user declaration when registering an AG-UI endpoint, while preserving queued approval results and repeated single-chunk text deltas.

Event Source published Indexed Verified

Why it matters

Generative UI puts client state, thread recovery, and approval for sensitive tools into one interaction path. Treating a thread ID as an access credential or allowing a client snapshot to replace approval state can cross tenant and authorization boundaries. These releases turn those hidden assumptions into explicit, fail-closed hosting contracts.

A closer look

Version 1.22.0 tightens request trust boundaries, binds workflow continuation and interrupts to the resolved thread identity, and keeps approval state authoritative on the server even when AG-UI wraps an agent that does not expose its middleware. Version 1.23.0 forces endpoint registration to select an authorization scope or declare a single-user deployment, reducing accidental use of a process-wide boundary in multi-user hosting. It also fixes loss of queued approval results and repeated single-chunk text deltas. The current official README further states that a thread ID is not a bearer credential: production apps must authenticate every request and choose a Snapshot Scope that represents a real user, tenant, or workspace boundary.

Who this is for

Backend, platform, and security teams hosting Microsoft Agent Framework AG-UI endpoints with shared state, workflow recovery, or human approval.

Original sources

Revisions & corrections (1)

— Outside-catalog backfill from two official Microsoft Agent Framework releases; merged because both define the same AG-UI trust boundary across thread recovery, server-owned approvals, and endpoint authorization.

Related events

Frameworks

AG-UI Kotlin 0.5.0 aligns with 1.0 through interrupts, activities, multimodality, and strict state boundaries

AG-UI released Kotlin core, client, and tools 0.5.0 on November 5. The SDK now targets AG-UI 1.0 with REASONING events, interrupt/resume outcomes, ACTIVITY snapshots and deltas, tool errors, and multimodal user messages, while adding browser Wasm and macOS Arm64 targets and tightening event, input, and RFC 6902 state validation.

AG-UI official immutable November 5 releaseOfficial
Frameworks

AI SDK 7.0.163 honors telemetry content controls and preserves Google streamed tool order and signature history

Vercel released AI SDK 7.0.163 on November 5. `recordInputs` and `recordOutputs` now govern content delivered to integrations and the `ai:telemetry` channel, filtering prompts, tool inputs, response text, and raw span results while retaining application results such as usage. The same release preserves the order of text, complete function calls, and thought signatures in streamed Google responses and across replayed history.

Vercel AI SDK official release and linked commitsOfficial
Frameworks

json-render 0.22 streams one generative-UI catalog into native Slack and Teams cards

json-render 0.22.0, released November 4, adds `@json-render/chat`. One component catalog can become a Chat SDK card; `streamCard` edits a thread message as elements arrive, while `toCard` validates the final card against component schemas and optional platform limits. The official example previews Slack Block Kit and Teams Adaptive Cards.

json-render official release and merged Chat SDK renderer pull requestOfficial