{"id":59726,"date":"2026-11-11T12:01:23","date_gmt":"2026-11-11T02:01:23","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/11\/microsoft-agent-framework-mcp-approval-policies-governance-guide\/"},"modified":"2026-11-11T12:03:40","modified_gmt":"2026-11-11T02:03:40","slug":"microsoft-agent-framework-mcp-approval-policies-governance-guide","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/11\/microsoft-agent-framework-mcp-approval-policies-governance-guide\/","title":{"rendered":"Microsoft Agent Framework MCP Approval Policies Governance Guide"},"content":{"rendered":"\n

In this blog post Microsoft Agent Framework MCP Approval Policies Governance Guide we will explain why a routine framework update can quietly change which AI actions need human sign-off, and what technology leaders should check before approving it for production.<\/p>\n\n\n\n\n\n\n\n

The issue is not whether an AI agent can answer questions. It is whether that agent can use connected tools to retrieve sensitive records, update customer data, send messages or trigger business processes without the right person reviewing the action.<\/p>\n\n\n\n

What the technology does in plain English<\/h2>\n\n\n\n

Microsoft Agent Framework is a development platform for building AI agents and multi-step AI workflows. These agents can use models from services such as Azure OpenAI and Anthropic Claude, maintain context and interact with other business systems.<\/p>\n\n\n\n

Model Context Protocol, usually called MCP, is a standard way to connect an agent to external tools. Think of MCP as a universal adapter that can let an agent search documents, query a database, create a service ticket or call an internal application.<\/p>\n\n\n\n

When an agent connects to an MCP server, it performs discovery. This means it asks the server which tools are available and what those tools claim to do.<\/p>\n\n\n\n

An approval policy then decides whether a person must approve a tool before the agent uses it. Without a sensible policy, businesses usually end up with one of two bad outcomes: every action requires approval and the system becomes frustrating, or too many actions run automatically and create unnecessary risk.<\/p>\n\n\n\n

What changed in the latest Python release<\/h2>\n\n\n\n

Microsoft Agent Framework Python 1.25.0, released on 9 November 2026, added callable MCP discovery approval policies. In practical terms, developers can now use policy logic to decide which discovered tools require approval instead of applying one fixed setting to everything.<\/p>\n\n\n\n

The release can also use approval information supplied through Microsoft Foundry Toolbox, including tool-name and read-only filters. It supports explicit caller overrides and can refresh approval decisions for tools retained after an MCP catalogue update.<\/p>\n\n\n\n

That last point matters. An MCP server can change the tools or metadata it publishes without your application necessarily being rebuilt, so approval decisions need to remain correct as the available catalogue changes.<\/p>\n\n\n\n

This release also includes other changes, including a move to Python 3.11 or later and new limits for MCP discovery. It should therefore be treated as a governed upgrade, not a small security feature that can be enabled in isolation. Our Microsoft Agent Framework release and upgrade governance guide explains how to test and approve these broader changes.<\/p>\n\n\n\n

Why callable policies matter to the business<\/h2>\n\n\n\n

Approvals can follow risk rather than inconvenience<\/h3>\n\n\n\n

A fixed policy may require the same approval for reading a public product guide and deleting a customer account. That creates approval fatigue, where employees start approving requests without properly reviewing them.<\/p>\n\n\n\n

A callable policy can evaluate information about each tool and apply different treatment. Low-risk searches may proceed automatically, while financial transactions, data changes and external communications pause for review.<\/p>\n\n\n\n

The business outcome is faster automation without giving the agent unrestricted authority.<\/p>\n\n\n\n

Read-only does not always mean harmless<\/h3>\n\n\n\n

The new support for read-only filtering is useful, but it should not become an automatic trust signal. A tool that only reads data could still retrieve payroll details, customer records, legal documents or commercially sensitive information.<\/p>\n\n\n\n

Approval decisions should consider both what the tool does and what information it can access. A read-only search of public documentation is very different from a read-only query across executive mailboxes.<\/p>\n\n\n\n

Metadata should be verified rather than blindly trusted<\/h3>\n\n\n\n

MCP servers publish descriptions and other information about their tools. This metadata helps the framework identify tools, but it is supplied by the server and may change when the server is updated.<\/p>\n\n\n\n

For important systems, tool metadata should be treated as an input to your policy rather than the final security decision. CloudPro Inc generally recommends an approved list of MCP servers, known tool names and independently defined risk categories.<\/p>\n\n\n\n

Overrides need their own controls<\/h3>\n\n\n\n

Explicit caller overrides allow an application to replace a default approval decision. This can be useful when a trusted workflow has additional context, but an override can also become a shortcut around governance.<\/p>\n\n\n\n

Overrides should only be available to approved application components. Every override should record who or what requested it, which policy was bypassed, the reason and the final outcome.<\/p>\n\n\n\n

What a practical policy might look like<\/h2>\n\n\n\n

The following simplified pseudocode illustrates the decision model. It is not intended as a drop-in production configuration.<\/p>\n\n\n\n

def decide_approval(tool, user, environment):\n if tool.server not in APPROVED_MCP_SERVERS:\n return "block"\n\n if tool.name in HIGH_RISK_TOOLS:\n return "human_approval_required"\n\n if tool.read_only and tool.data_classification == "public":\n return "allow"\n\n if environment == "production":\n return "human_approval_required"\n\n return "block"<\/code><\/pre>\n\n\n\n
The important point is that the decision is based on several factors. These include the server, tool, data classification, user and environment rather than trusting a single label.<\/p>\n\n\n\n
For more detail on designing the approval flow itself, see how MCP approval policies secure Microsoft AI agent tool use. The next governance step is ensuring those policies remain effective across releases, catalogue refreshes and changing business permissions.<\/p>\n\n\n\n
A realistic governance scenario<\/h2>\n\n\n\n
Consider a 200-person professional services company introducing an agent to help its finance and operations teams. The agent connects to an MCP server offering tools for searching invoices, viewing customer accounts, changing payment details and emailing suppliers.<\/p>\n\n\n\n
If every tool is automatically approved, a misleading email or poorly worded request could lead the agent towards a sensitive action. If every tool requires approval, employees will spend their day confirming routine invoice searches.<\/p>\n\n\n\n
A risk-based policy provides a better balance:<\/p>\n\n\n\n
    \n
  • Searching general invoice status can run automatically for authorised finance employees.<\/li>\n
  • Reading bank details requires approval because the information is sensitive.<\/li>\n
  • Changing payment details requires approval from a separate finance manager.<\/li>\n
  • Sending an external payment instruction requires a second verification step.<\/li>\n
  • Any unrecognised tool or MCP server is blocked by default.<\/li>\n<\/ul>\n\n\n\n
    This approach reduces repetitive work while retaining human control over actions that could cause financial loss, privacy incidents or fraud.<\/p>\n\n\n\n
    What CIOs and CTOs should review now<\/h2>\n\n\n\n
      \n
    1. Inventory every MCP connection.<\/strong> Record the owner, server location, authentication method, available tools and business systems each connection can reach.<\/li>\n
    2. Classify tools by business impact.<\/strong> Separate public information searches from sensitive reads, record changes, external communications, code execution and financial actions.<\/li>\n
    3. Set a safe default.<\/strong> New or unclassified tools should be blocked or require approval until they have been reviewed.<\/li>\n
    4. Validate read-only claims.<\/strong> Confirm the underlying system permissions and data scope rather than relying only on published metadata.<\/li>\n
    5. Control policy overrides.<\/strong> Limit who can introduce an override, require a documented reason and include overrides in security monitoring.<\/li>\n
    6. Test catalogue refreshes.<\/strong> Confirm that renamed, replaced and retained tools receive the correct policy when an MCP server changes its catalogue.<\/li>\n
    7. Record meaningful audit evidence.<\/strong> Capture the tool, arguments, requesting identity, approval decision, policy version, target system and result.<\/li>\n
    8. Test the complete release.<\/strong> Pin the framework version, test it outside production and maintain a rollback path. Our release cadence and version governance guide provides a practical model.<\/li>\n<\/ol>\n\n\n\n
      How this supports Australian security requirements<\/h2>\n\n\n\n
      MCP approval policies do not make an organisation compliant on their own. However, they can support the intent of the Essential Eight, the Australian Government’s cybersecurity framework that many organisations are expected or required to follow.<\/p>\n\n\n\n
      They are particularly relevant to restricting administrative privileges, controlling changes and creating evidence that sensitive actions were authorised. They can also support privacy and audit obligations by reducing unnecessary access to personal information.<\/p>\n\n\n\n
      The policy still needs strong identity controls, limited system permissions, secure authentication and monitoring. Where possible, the agent should use Microsoft Entra identities with only the permissions required for its specific job rather than shared accounts with broad access.<\/p>\n\n\n\n
      The governance decision is bigger than one feature<\/h2>\n\n\n\n
      Callable MCP approval policies are a useful improvement because they allow controls to match real business risk. They do not remove the need for careful server selection, least-privilege access, testing, logging and release management.<\/p>\n\n\n\n
      CloudPro Inc combines more than 20 years of enterprise IT experience with practical work across Azure, Microsoft 365, OpenAI, Claude, Microsoft Defender and Wiz. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations assess these controls without turning a useful AI project into a giant compliance exercise.<\/p>\n\n\n\n
      If you are not sure whether your agents have the right approval boundaries, or whether the latest Agent Framework release is safe for your environment, we are happy to take a practical look with you \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"
      Microsoft Agent Framework 1.25 adds more flexible MCP approval controls. Here is what technology leaders should review before allowing AI agents to act across business systems.<\/p>\n","protected":false},"author":1,"featured_media":59728,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[121,13,68,113],"tags":[],"class_list":["post-59726","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-governance-risk-management","category-blog","category-mcp-server","category-microsoft-agent-framework"],"jetpack-related-posts":[{"id":59674,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/09\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use\/","url_meta":{"origin":59726,"position":0},"title":"How MCP Approval Policies Secure Microsoft AI Agent Tool Use","author":"CPI Staff","date":"November 9, 2026","format":false,"excerpt":"MCP approval policies stop AI agents from taking sensitive actions unchecked. Learn how to apply practical approval controls in Microsoft Agent Framework without creating unnecessary delays.","rel":"","context":"In "AI Governance & Risk Management"","block_context":{"text":"AI Governance & Risk Management","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-governance-risk-management\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use.png 1x, \/wp-content\/uploads\/2026\/11\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use.png 1.5x, \/wp-content\/uploads\/2026\/11\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use.png 2x, \/wp-content\/uploads\/2026\/11\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use.png 3x, \/wp-content\/uploads\/2026\/11\/how-mcp-approval-policies-secure-microsoft-ai-agent-tool-use.png 4x"},"classes":[]},{"id":58659,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance\/","url_meta":{"origin":59726,"position":1},"title":"Microsoft Agent Framework Production Guide for A2A MCP Governance","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"The latest Microsoft Agent Framework releases improve long-running work, A2A reliability, MCP support and runtime controls. Here is what technology leaders should review before production.","rel":"","context":"In "AI Governance & Risk Management"","block_context":{"text":"AI Governance & Risk Management","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-governance-risk-management\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 1x, \/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 1.5x, \/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 2x, \/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 3x, \/wp-content\/uploads\/2026\/08\/microsoft-agent-framework-production-guide-for-a2a-mcp-governance.png 4x"},"classes":[]},{"id":59686,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/10\/mcp-tool-approval-policies-every-australian-cio-should-adopt\/","url_meta":{"origin":59726,"position":2},"title":"MCP Tool Approval Policies Every Australian CIO Should Adopt","author":"CPI Staff","date":"November 10, 2026","format":false,"excerpt":"A practical governance model for deciding which MCP tools AI agents may run automatically, which need human approval, and how to reduce risk without slowing useful automation.","rel":"","context":"In "AI Agents"","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-every-australian-cio-should-adopt.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-every-australian-cio-should-adopt.png 1x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-every-australian-cio-should-adopt.png 1.5x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-every-australian-cio-should-adopt.png 2x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-every-australian-cio-should-adopt.png 3x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-every-australian-cio-should-adopt.png 4x"},"classes":[]},{"id":59638,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/08\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe\/","url_meta":{"origin":59726,"position":3},"title":"MCP Tool Approval Policies That Keep Microsoft AI Agents Safe","author":"CPI Staff","date":"November 8, 2026","format":false,"excerpt":"MCP tool approvals stop AI agents from taking sensitive actions without oversight. Here is a practical governance model for balancing productivity, security and accountability.","rel":"","context":"In "AI Governance & Risk Management"","block_context":{"text":"AI Governance & Risk Management","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-governance-risk-management\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe.png 1x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe.png 1.5x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe.png 2x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe.png 3x, \/wp-content\/uploads\/2026\/11\/mcp-tool-approval-policies-that-keep-microsoft-ai-agents-safe.png 4x"},"classes":[]},{"id":59271,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/20\/microsoft-agent-framework-production-release-and-pinning-guide\/","url_meta":{"origin":59726,"position":4},"title":"Microsoft Agent Framework Production Release and Pinning Guide","author":"CPI Staff","date":"October 20, 2026","format":false,"excerpt":"Learn what to pin, how often to upgrade and which governance controls keep Microsoft Agent Framework production systems stable, secure and recoverable.","rel":"","context":"In "AI Agents"","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-production-release-and-pinning-guide.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-production-release-and-pinning-guide.png 1x, \/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-production-release-and-pinning-guide.png 1.5x, \/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-production-release-and-pinning-guide.png 2x, \/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-production-release-and-pinning-guide.png 3x, \/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-production-release-and-pinning-guide.png 4x"},"classes":[]},{"id":59511,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/02\/microsoft-agent-framework-1-x-stability-and-production-risk-guide\/","url_meta":{"origin":59726,"position":5},"title":"Microsoft Agent Framework 1.x Stability and Production Risk Guide","author":"CPI Staff","date":"November 2, 2026","format":false,"excerpt":"Microsoft Agent Framework 1.x is production-ready, but its rapid release cycle still needs careful control. Here is how CIOs can balance innovation, stability and business risk.","rel":"","context":"In "AI Agents"","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-1-x-stability-and-production-risk-guide.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-1-x-stability-and-production-risk-guide.png 1x, \/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-1-x-stability-and-production-risk-guide.png 1.5x, \/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-1-x-stability-and-production-risk-guide.png 2x, \/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-1-x-stability-and-production-risk-guide.png 3x, \/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-1-x-stability-and-production-risk-guide.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/11\/microsoft-agent-framework-mcp-approval-policies-governance-guide.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59726","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59726"}],"version-history":[{"count":2,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59726\/revisions"}],"predecessor-version":[{"id":59729,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59726\/revisions\/59729"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59728"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59726"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59726"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59726"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}