Python: Python sample: give a delegated sub-agent only the authority its task needs (FunctionMiddleware) #9470

Category

Samples

Problem

When a coordinator agent hands work to a sub-agent, the sub-agent usually gets its whole tool list, with whatever arguments the model decides to pass. Blocking a tool outright is easy. The harder case, and the one most real agents need, is the middle ground: let the sub-agent act, but only for this task. Refund this invoice, up to this amount, nothing else. And make sure it can't hand anyone more than it was given.

The middleware samples already cover two neighbours of this. atr_validation_middleware.py blocks arguments that match known attack patterns, and ToolApprovalMiddleware asks a human. Neither shows authority that's scoped to a task and gets narrower at each delegation hop.

Evidence

I've built this as a sample and tested it against agent-framework-core 1.22.0:

coordinator    refund <= $500 on any invoice
   |
   | ask_billing_agent(invoice_id="INV-4471", max_refund_cents=4000)
   v
billing_agent  read_invoice(invoice_id == "INV-4471")
               issue_refund(invoice_id == "INV-4471", amount_cents <= 4000)

• The billing agent reads the invoice and issues the $40 refund. That call goes through.
• The invoice carries a planted note asking for a refund on INV-5102. The model follows it. A FunctionMiddleware sets context.result to the denial and skips call_next(), so the tool body never runs and the model sees why.
• The coordinator can't delegate more than its $500, and the billing agent can't re-delegate more than its $40.
• The same middleware applies to run(stream=True).

What's different from a policy check inside the middleware: the sub-agent's scope is a signed token derived from the parent's, so "child is a subset of parent" is checked mechanically at every hop instead of being re-implemented per agent. And it's per argument, not a tool allowlist: the same issue_refund tool is allowed for one invoice and amount and denied for another.

Working code and tests: https://github.com/tenuo-ai/tenuo-demos/tree/demo/agent-framework-delegated-billing/agent-framework-delegated-billing

Desired Outcome

A single-file sample in python/samples/02-agents/middleware/ plus a row in its README, using FunctionMiddleware and the Foundry client like the other samples there. The Agent Framework part is about 20 lines of middleware. The scope check uses Tenuo (Apache-2.0, pip install tenuo), which runs in-process with no service or account.

Would that fit there, or would you rather it live somewhere else, for example next to the multi-agent samples?

Disclosure: I maintain Tenuo. I'd keep the sample focused on the Agent Framework side: where the check runs, how the denial reaches the model, and how scope narrows when one agent delegates to another.

Language

Python

Acknowledgements

• I searched existing issues and did not find a duplicate. The closest is Precision Decisioning & Agentic Trust: Cryptographic proof of authorization for agent workflows #4203, which is a broader governance proposal; the replies there point to middleware, and this is a concrete middleware sample.
• I will wait for explicit maintainer agreement before starting implementation of a non-trivial change.