AutoGen tools: authorize AI agent tool calls
A practical Microsoft AutoGen guide for checking tool calls before execution with policy, approval, and decision records.
Page audit
- Cited source ledger with May 27, 2026 access dates.
- Action-time policy, approval, and evidence model.
- Primary conversion path points to a demo; developer pages also point to install.
Microsoft AutoGen gives agents a way to call tools. Veto belongs at the dispatch point where your application still has the concrete tool name, arguments, actor, tenant, and environment.
Where to put the check
Intercept autogen_tool after the model proposes the action and before your code calls the real service. The policy decision should be fail-closed for deny and pause on require_approval.
| Control | Implementation |
|---|---|
| Tool identity | Evaluate the exact autogen_tool name, not only the prompt that produced it. |
| Arguments | Check amount, tenant, target record, environment, and data class. |
| Approval | Route review-required actions to the responsible human before execution. |
| Evidence | Store the decision record with source, policy version, verdict, and reviewer. |
Minimal wrapper
const decision = await veto.protect({
tool: "autogen_tool",
arguments: input,
context: {
actorId,
tenantId,
environment: "production",
},
})
if (decision.action === "deny") {
throw new Error(decision.reason)
}
if (decision.action === "require_approval") {
await veto.waitForApproval({ decisionId: decision.id })
}
return executeTool(input)This pattern keeps the model useful while moving authority into application code. The agent can suggest an action; the runtime decides whether the action may happen.
Sources
FAQ
What should a team authorize before running autogen_tool?⌄
Authorize the exact tool name, arguments, actor, tenant, environment, and review requirement before the side effect reaches the upstream system.
Why not rely on prompts for this?⌄
Prompts guide model behavior, but they do not reliably stop a tool dispatch. Runtime authorization sits after the model proposes an action and before the tool executes.
What evidence should the page produce?⌄
Keep a decision record with the actor, tool, arguments summary, policy version, verdict, reviewer when required, timestamp, and source system context.
Related paths
Govern the next agent action