Security

Microsoft ships real code for every guardrail layer, but no sample wires them together around one agent. Here’s the reference stack — Presidio for PII, Content Safety for harm categories, NeMo Guardrails for programmable rails, FIDES for deterministic flow control — where each fits in the MAF middleware pipeline, and the licenses.

Prompt Shields is a real input classifier, but it’s probabilistic — and Spotlighting and Groundedness are model-only, so an agent’s tool calls can pass completely unscanned. Here’s what each defense blocks, where the agent coverage gap is, and how to layer probabilistic filters with deterministic controls.

Microsoft Agent Framework’s latest releases, Python 1.10.0 (June 30) and .NET 1.12.0 (July 2), change a security default that’s easy to miss in the changelog: agent tools and file access now require approval unless you opt out. Both land as breaking changes.

The OWASP LLM Top 10 exists because shipping an LLM to production without a security model is a new category of risk that the existing web application security playbook doesn’t fully cover. Prompt injection has held the #1 spot on that list since the first version was published, and it’s not there because researchers think it might be a problem someday. It’s been demonstrated against production systems at companies that knew what they were doing.