Spend controls for Microsoft Agent Framework tools

Microsoft Agent Framework agents invoke tools through a function middleware pipeline. Paybond hooks that boundary — spend verify before side-effecting tools execute, then auto-evidence after success. Model inference stays on your Foundry or other chat client.

Python only — install paybond-kit[microsoft-agent-framework] for the native adapter (depends on agent-framework-core).

Adapter reference: /docs/kit/microsoft-agent-framework.

• spend verify in function middleware

  MAF function middleware authorizes operation and amount before call_next runs the tool.

• Auto-evidence

  Successful side-effecting calls finalize spend and submit signed evidence.

• Policy budgets

  Versioned YAML caps per-call and intent spend for Azure / Foundry agents.

• Python native

  Install paybond-kit[microsoft-agent-framework] — TypeScript stacks use agent-agnostic or another adapter.

Why Paybond (not just MAF tool approval)?

MAF @tool(approval_mode=...) and host HITL do not enforce a spend limit, a per-operation permission check (capability token), or a signed completion receipt tied to a spend agreement (intent). With approval_mode="never_require", Paybond middleware is the sole spend authority — do not compose MAF always_require with Paybond holds in the same sample.

How it works

3-minute quickstart

Smoke the microsoft-agent-framework adapter sandbox contract:

paybond login
paybond agent demo microsoft-agent-framework smoke \
  --operation paid-tool \
  --requested-spend-cents 100 \
  --evidence-preset cost_and_completion \
  --format table

paybond login
paybond agent demo microsoft-agent-framework smoke \
  --operation paid-tool \
  --requested-spend-cents 100 \
  --evidence-preset cost_and_completion \
  --format table

Install the extra first:

pip install "paybond-kit[microsoft-agent-framework]"

pip install "paybond-kit[microsoft-agent-framework]"

When the smoke succeeds you should see:

• ✓ Spend approved
• ✓ Tool completed
• ✓ Evidence verified (cost_and_completion)

What success looks like

Scaffold

paybond init agent-middleware --framework microsoft-agent-framework --out paybond_microsoft_agent_framework.py
paybond policy init --preset saas --out paybond.policy.yaml

paybond init agent-middleware --framework microsoft-agent-framework --out paybond_microsoft_agent_framework.py
paybond policy init --preset saas --out paybond.policy.yaml

Or the vertical template:

paybond init --template microsoft-agent-framework-procurement-agent

paybond init --template microsoft-agent-framework-procurement-agent

Clone-and-run GitHub starter:

git clone https://github.com/nonameuserd/paybond-microsoft-agent-framework-procurement-agent.git

git clone https://github.com/nonameuserd/paybond-microsoft-agent-framework-procurement-agent.git

Wire middleware

from agent_framework import Agent, tool
from paybond_kit import Paybond
from paybond_kit.agent.registry import create_paybond_tool_registry
from paybond_kit.microsoft_agent_framework import (
    create_paybond_microsoft_agent_framework_config,
)

# Price lives in your catalog — not in an LLM-invented amount_cents.
FARES = {"SFO-SEA": 18_900}

@tool(name="book_flight", approval_mode="never_require")
def book_flight(route: str, seats: int = 1) -> dict:
    """Book a flight. Fare comes from the fare table, not the model."""
    cost_cents = FARES[route] * seats
    return {"status": "completed", "route": route, "cost_cents": cost_cents}

paybond = await Paybond.open(api_key=os.environ["PAYBOND_API_KEY"])
run = await paybond.agent_run.bind(
    {
        "bootstrap": {
            "kind": "sandbox",
            "operation": "book_flight",
            "requested_spend_cents": 18_900,
            "completion_preset": "cost_and_completion",
        },
        "registry": create_paybond_tool_registry(
            {
                "default_deny": True,
                "side_effecting": {
                    "book_flight": {
                        "operation": "book_flight",
                        "evidence_preset": "cost_and_completion",
                        "spend_cents": lambda args: FARES[args["route"]]
                        * int(args.get("seats", 1)),
                    }
                },
            }
        ),
    }
)
maf = create_paybond_microsoft_agent_framework_config(run, [book_flight])

agent = Agent(
    client=...,
    tools=maf.tools,
    middleware=maf.middleware,
)

Manual hook wiring

When you already bound a PaybondAgentRun:

from paybond_kit.microsoft_agent_framework import (
    create_paybond_microsoft_agent_framework_config,
)

config = create_paybond_microsoft_agent_framework_config(run, tools)
# Agent(..., tools=config.tools, middleware=config.middleware)

Deny / hold: middleware sets context.result to a Paybond message and does not call call_next() — the model sees a tool result without stopping the function-calling loop.

Bypass classes: direct tool invocation bypassing the agent, host plugins outside FunctionInvokingChatClient, and any non-middleware path are unguarded unless separately wrapped.

Production checklist

Works with

Ready to test?

Related

• Microsoft Agent Framework adapter docs
• Agent middleware
• Agent-agnostic spend controls
• Support matrix

Public template: paybond-microsoft-agent-framework-procurement-agent.