Microsoft Agent Framework: Human-in-the-Loop Tool Approval with .NET
Agent Framework can pause an agent before a sensitive tool runs, using ApprovalRequiredAIFunction, until a person approves. The author shows the approval loop in a console app and over the Responses protocol on Microsoft Foundry. On Foundry, an approved booking still ends in a failed run, a caveat every hosted approval flow should account for.
Key points
- Wrap side-effect tools in ApprovalRequiredAIFunction; the tool implementation stays the same.
- Tell the agent to call the tool directly and not ask for confirmation in chat.
- In a console app, read ToolApprovalRequestContent and reply with request.CreateResponse(approved).
- On Foundry, approvals arrive as mcp_approval_request items and are answered with mcp_approval_response.
- Keep previous_response_id (the caresp_ id) and approval_request_id (the mcpr_ id) separate.
- After an approval, the response can still be marked failed, so inspect the output items, not just the status.
Microsoft Agent Framework can stop an agent before a tool with side effects runs and wait for a person to approve it. This post wraps a restaurant booking tool in ApprovalRequiredAIFunction. In a console app, the run returns early with a ToolApprovalRequestContent. The app asks the user, answers with CreateResponse, and the run resumes from where it stopped.
The author repeats the flow on a hosted agent in Microsoft Foundry, using the Responses protocol with raw HTTP. The approval arrives as an mcp_approval_request item, and the answer is sent as an mcp_approval_response tied to the earlier response by previous_response_id. The booking succeeds, but the response is still marked failed with a server error, and the container logs show nothing. Clients that only check HTTP status will miss this. The issue has been reported to the agent-framework repository as 8577.
Real-world use
- A customer support agent that books reservations, sends emails or charges payments and needs a person to confirm each action.
- An operations assistant that deletes files or changes database rows, gated by an approver before each change.
- A team hosting an agent on Microsoft Foundry that needs an approval step over the Responses protocol.
Why it matters
Approval gates for side-effect tools can now use the framework's built-in mechanism instead of a custom pause. On hosted Foundry agents, though, an approved action can come back as failed, so check the returned output items rather than relying on the HTTP status alone.