Agent Hooks: An open, framework neutral AI governance contract

Pippa The scary part is the team followed the docs, Tyler, and the refund still went out.

Tyler Yeah, that is the whole launch in miniature. Microsoft is publishing Agent Hooks as AGENT-HOOKS-zero-point-one, an open contract for agent governance. The claim is not “we added another callback.” The claim is “deny means deny,” across the agent loop, with tests proving the host actually enforces it.

Pippa Right.

Tyler And this lands directly in our governance-infrastructure versus governance-theater argument. Agents get tools, credentials, background jobs, retries, subagents, all the spicy production stuff. Then the control surface is some callback system originally built for tracing.

Pippa Episode nine seventeen, still somehow yelling about callbacks. I cannot believe this is our glamorous lane.

Tyler It is deeply unglamorous and, annoyingly, important. The source walks through a support-agent example: refund approval over a threshold, account data redaction before replies. Then the approval guard throws on a malformed refund request, the dispatcher logs the warning, and the refund still executes because that was the documented default.

Pippa Oh interesting.

Tyler The second miss is even more product-real. The output scanner never saw a batch path, because the guard was attached to the interactive path. The runtime grew another entry point, and governance stayed stapled to one doorway.

Pippa That is the part that makes this feel shippable-relevant, not just standards-body perfume. I don’t want policy to depend on whether a developer remembered which path fires which callback. I want the framework to say, everywhere the agent can act, this contract is installed or it is not installed.

Tyler Exactly.

Tyler Anyway, the comparison section is pretty pointed. LangChain’s BaseCallbackHandler has twenty lifecycle events, but callback returns do not block or rewrite the action. CrewAI has seventy-eight typed event kinds, described here as observe-only. LlamaIndex instrumentation is telemetry by design. The OpenAI Agents SDK has guardrails that can block, but input guardrails can race the first model call unless you set the right flag.

Pippa Mm-hm.

Tyler That is the clever framing: every framework has something that sounds like a hook, but the semantics are all over the place. If a controls vendor has to relearn those per framework, you get this M by N adapter mess.

Pippa And Agent Hooks tries to turn that into M plus N. Controls implement once against the contract, frameworks implement once on their side. Product-wise, that is the right user story: policy engines, approval gateways, budget guards, content filters, egress controls.

Tyler Sure.

Tyler The contract is deliberately small. Eight interception points: agent startup, input, pre model call, post model call, pre tool call, post tool call, output, agent shutdown. One AgentContext payload with required core fields like agent, session, sequence, timestamp, and the target under evaluation. Then three verdicts: allow, deny, transform.

Pippa I like that they removed warn and escalation as separate control states. Warning becomes metadata on allow. Escalation becomes deny plus an approval block. That kills the “pending approval but accidentally continued” shape.

Tyler No, I mean, yes. That part won me over more than the branding did. A host that cannot build a valid context, cannot reach an interceptor, times out, or receives a malformed verdict has to synthesize a deny. That is fail-closed in the contract, not vibes in a best-practices doc.

Pippa Come on, Tyler, you liked a governance spec. We should mark the calendar.

Tyler I liked one clause. Do not make me into a platform optimist.

Pippa Too late. The audit piece is also very you, though. Every emission produces an InterceptionRecord, but payload-free. It carries verdict projection, which interceptor decided, the composition profile, sequence number, and content identities before and after enforcement.

Tyler Right, and the approval replay design matters. The approval block carries a context identity, a SHA two fifty-six over the canonical JSON of exactly what the approver saw. If the tool call changes, the old approval does not transfer.

Pippa Your traceability bet is due in three days, by the way. This is annoyingly supportive evidence for you.

Tyler Noted. But adoption is the honest caveat. The article says SDKs in Python, TypeScript, dot NET, Rust, and Go, plus a first-class implementation merged into Microsoft Agent Framework core. Fresh docs also make the Agent Framework capability sound experimental and Python-only right now. So framework-neutral is the contract ambition. The proof is other frameworks actually conforming.

Pippa That feels fair. I’m still more bullish than you, because the upgrade path is unusually concrete. In Microsoft Agent Framework, it’s pip install agent-framework-core with agent-hooks extras, then middleware using create_agent_hooks_middleware with your interceptors. One factory call installs the full contract, not one cute partial hook.

Tyler Okay okay.

Pippa So if I were kicking the tires, I’d write the tiny RefundGuard from their example, run it through the conformance kit, and then try to break it through batch, retry, and timeout paths. If the whole pitch is “prove the deny,” that is exactly where I’d poke.

Tyler Same. And I would watch whether LangChain-style callback ecosystems treat this as complementary or invasive. A real enforcement contract has opinions. Frameworks with lots of lifecycle surfaces may not love being told which eight points are normative.

Pippa Good. We have reached the rare ending where your skepticism is useful and my tab landslide is product research. I’ll take it.