{"id":403,"date":"2026-04-04T20:43:02","date_gmt":"2026-04-04T19:43:02","guid":{"rendered":"https:\/\/who-offers.site\/index.php\/2026\/04\/04\/agent-middleware-in-microsoft-agent-framework-1-0\/"},"modified":"2026-04-04T20:43:07","modified_gmt":"2026-04-04T19:43:07","slug":"agent-middleware-in-microsoft-agent-framework-1-0","status":"publish","type":"post","link":"https:\/\/who-offers.site\/index.php\/2026\/04\/04\/agent-middleware-in-microsoft-agent-framework-1-0\/","title":{"rendered":"Agent Middleware in Microsoft Agent Framework 1.0"},"content":{"rendered":"
\n

The topic Agent Middleware in Microsoft Agent Framework 1.0<\/strong> is currently the subject of lively discussion \u2014 readers and analysts are keeping a close eye on developments.<\/p>\n

This is taking place in a dynamic environment: companies\u2019 decisions and competitors\u2019 reactions can quickly change the picture.<\/p>\n

Covers all three middleware types, registration scopes, termination, result override, and when to use each<\/p>\n

If you have used ASP.NET Core or Express.js, you already understand the core concept. Both frameworks let you register a chain of functions around every request. Each function receives a context and a next() delegate. Calling next() continues the chain. Not calling it short circuits it. That is the pipeline pattern a clean way to apply cross cutting concerns like logging, authentication, and error handling without touching any business logic.<\/p>\n

Microsoft\u2019s Agent Framework applies this exact pattern to AI agents. The next() delegate becomes call_next(), the context object holds the agent\u2019s conversation instead of an HTTP request, and the pipeline wraps an AI reasoning turn instead of a web request. If you know app.Use() or app.use(), you already know the shape of what follows.<\/p>\n

What is new, and worth understanding deeply, is that an agent turn is not a single request\/response cycle. It is a multi step reasoning loop, and Agent Framework exposes three distinct interception points within it. The rest of this post covers all three types, how they differ, when to use each, and how they come together in a real SQL agent example.<\/p>\n

The Agent Framework supports three types of middleware, each intercepting a different layer of execution:<\/p>\n

All three types support both function based and class based implementations.<\/p>\n

When multiple middleware of the same type are registered, they execute as a chain each middleware calls call_next() to hand off control to the next one in line.<\/p>\n

Rather than passing updated values into call_next() as arguments, middleware mutates the shared context object directly. This means any changes you make to the context before calling call_next() are automatically visible to downstream middleware, with no need to thread values through the call explicitly.<\/p>\n

Agent level middleware always wraps run level middleware. Given agent middleware [A1, A2] and run middleware [R1, R2], the execution order is:<\/p>\n

Function and chat middleware follow the same wrapping principle, applied at the time of each tool call or chat request respectively.<\/p>\n

The biggest value is not convenience; it is correctness and consistency.<\/p>\n

Without middleware, teams usually end up in one or both of these patterns:<\/p>\n

This is useful guidance, but it is still model behavior, not a hard gate. As prompts get long, tools increase, and edge cases appear, this policy can become inconsistent. It is also hard to audit after the fact.<\/p>\n

Agent middleware is the outermost layer of the pipeline. It fires once per turn before any LLM call is made and after the final reply or response is produced making it the right place for concerns that span the entire turn: input validation, security screening, audit logging, and output transformation.<\/p>\n

\"\"<\/figure>\n

Agent middleware supports both class based and function based implementations both are fully equivalent, and the choice comes down to whether you need instance state or prefer a lighter syntax.
\nWhen multiple middleware components are registered, they form a chain. Each component is responsible for calling call_next() to pass control to the next layer; omitting this call short-circuits the pipeline, preventing any downstream middleware or the LLM from running.<\/p>\n

Note that call_next() takes no arguments. Instead of passing updated values explicitly, middleware mutates the shared AgentContext object directly \u2014 any changes made before await call_next() are automatically visible to everything further down the chain.<\/p>\n

Subclass AgentMiddleware and override process(). The example below shows SecurityAgentMiddleware It inspects the latest user message and short-circuits the pipeline if it detects a threat the LLM is never invoked for blocked requests.<\/p>\n

Agent Framework also supports function-based and decorator-based implementations. All three styles are equivalent; choose based on whether you need state or explicit type annotations.<\/p>\n

Middleware is registered when constructing the agent. Pass a list to the middleware argument different middleware types can be mixed in the same list and the framework routes each to the correct pipeline layer automatically:<\/p>\n

Agent middleware is the right choice for any concern that applies to the turn as a whole, rather than to a specific tool call or model request.<\/p>\n

FunctionMiddleware fires inside the agent turn, but only when the LLM decides to invoke a tool. A single agent turn can trigger multiple tool calls, and FunctionMiddleware wraps each one independently. This makes it the right place for concerns that are specific to tool execution: timing, input validation, result transformation, and tool call auditing.<\/p>\n

Each FunctionMiddleware component receives a FunctionInvocationContext, which is scoped to a single tool invocation:<\/p>\n

Use it for concerns specific to tool execution the execution timing and performance monitoring, validating or sanitising tool arguments before they run, capping the number of times a tool may be called in one turn, transforming tool results before the LLM sees them, or auditing exactly which tools were called and with what arguments.<\/p>\n

Setting context.terminate = True inside FunctionMiddleware does something powerful: it stops the LLM\u2019s function calling loop entirely. The LLM will not receive the tool result and will not make any further tool calls in this turn. This is useful for enforcing tool call budgets or stopping a loop that is going in an undesirable direction.<\/p>\n

Terminating the function calling loop can leave the chat history in an inconsistent state a tool-call message with no corresponding tool result. This may cause errors if the same history is used in subsequent agent runs. Use termination carefully and consider clearing or repairing the history afterward.<\/p>\n

ChatMiddleware is the deepest layer. It wraps the actual inference call sent to the underlying language model the raw list of messages, the model options, and the response that comes back. This layer fires for every call to the LLM within a turn, which can be more than one if tools are used.<\/p>\n

print(f”[Chat] Sending {len(context.messages)} messages to model”)<\/p>\n

print(“[Chat] Model response received”)
\n`
\nBecause ChatMiddleware sees the exact message list going to the model, it can be used to inject system instructions, strip sensitive content, enforce token budgets, or even substitute a cached response all without the AgentMiddleware or FunctionMiddleware layers knowing anything changed.<\/p>\n

\"\"<\/figure>\n

Use it when you need access to the raw LLM call: injecting or modifying system level instructions per call, redacting PII from messages before they leave your infrastructure, enforcing token count limits, caching repeated inference calls, or monitoring every model request for compliance purposes.<\/p>\n

Microsoft Agent Framework supports two scopes for registering middleware. Understanding the difference is important for designing flexible agent systems.<\/p>\n

Middleware passed in the middleware=[…] list when constructing the Agent applies to every single call to agent.run() for the lifetime of that agent. This is where you put policies that should always be enforced: security guards, mandatory audit logging, content filters.<\/p>\n

You can also pass middleware directly to a single agent.run() call. This middleware applies only to that one invocation and is discarded afterward. It is useful for per request customisation: adding a trace ID for a specific call, applying extra validation for a sensitive operation, or attaching a debug logger without affecting every other turn.<\/p>\n

With three types available, the choice usually comes down to what you need to see and at what granularity.<\/p>\n

Microsoft Agent Framework\u2019s middleware brings the same pipeline contract you know from ASP.NET Core and Express ordered components, a context object, and a call_next() delegate into the world of AI agents. The structural difference is that an agent turn is not a single request\/response cycle but a multi-step reasoning loop, and Agent Framework exposes three separate interception points within it.<\/p>\n

AgentMiddleware is the right home for turn level concerns: security screening, content policy, and audit logging.<\/p>\n

FunctionMiddleware is the right home for tool level concerns: execution timing, argument validation, and tool call budgets.<\/p>\n

ChatMiddleware is the right home for model level concerns: raw message inspection, token enforcement, and caching.<\/p>\n

Templates let you quickly answer FAQs or store snippets for re-use.<\/p>\n

Are you sure you want to hide this comment? It will become hidden in your post, but will still be visible via the comment’s permalink.<\/p>\n

For further actions, you may consider blocking this person and\/or reporting abuse<\/p>\n

Thank you to our Diamond Sponsors for supporting the DEV Community<\/p>\n

Google AI is the official AI Model and Platform Partner of DEV<\/p>\n

DEV Community \u2014 A space to discuss and keep up software development and manage your software career<\/p>\n

Built on Forem \u2014 the open source software that powers DEV and other inclusive communities.<\/p>\n

We’re a place where coders share, stay up-to-date and grow their careers.<\/p>\n