{"id":5547,"date":"2026-06-29T03:41:33","date_gmt":"2026-06-29T10:41:33","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/agent-framework\/?p=5547"},"modified":"2026-06-29T03:41:33","modified_gmt":"2026-06-29T10:41:33","slug":"agent-harness-working-with-your-data-safely","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/agent-framework\/agent-harness-working-with-your-data-safely\/","title":{"rendered":"Agent Harness: Working with your data, safely"},"content":{"rendered":"

Part 2 of Build your own claw and agent harness with Microsoft Agent Framework<\/a>.<\/em><\/p>\n

In Part 1<\/a> we stood up a harness and gave our personal finance assistant its first abilities: a custom tool, web search, and planning. It can talk<\/em> about the markets – but it can’t yet touch your<\/em> data, and nothing stops it from taking a sensitive action on a whim.<\/p>\n

This part fixes both, using three abilities that are all included in the harness:<\/p>\n

    \n
  1. File access<\/strong> – read your portfolio from a CSV and write reports back to disk.<\/li>\n
  2. Approvals<\/strong> – gate risky actions (like placing a trade) behind a human’s explicit OK.<\/li>\n
  3. Durable memory<\/strong> – remember things across sessions, in two<\/em> complementary ways.<\/li>\n<\/ol>\n

    As before, we only supply what makes our agent ours<\/em>; the harness provides the machinery. Let’s take the three in turn.<\/p>\n

    Give it your data: file access<\/h2>\n

    Our assistant should work from the user’s actual<\/em> holdings, not made-up numbers. The harness includes a file-access provider<\/strong> that exposes a set of file_access_*<\/code> tools – list, read, write, search – over a default folder. We point it at a working\/<\/code> folder that already contains a portfolio.csv<\/code>.<\/p>\n

    C#:<\/p>\n

    AIAgent agent = chatClient.AsHarnessAgent(new HarnessAgentOptions\r\n{\r\n    \/\/ The agent can read\/write files under this folder via the file_access_* tools.\r\n    FileAccessStore = new FileSystemAgentFileStore(Path.Combine(AppContext.BaseDirectory, \"working\")),\r\n    ChatOptions = new ChatOptions { Instructions = instructions, Tools = [\/* ... *\/] },\r\n});<\/code><\/pre>\n
    Python:<\/p>\n
    from agent_framework import FileSystemAgentFileStore\r\n\r\nagent = create_harness_agent(\r\n    client=client,\r\n    agent_instructions=FINANCE_INSTRUCTIONS,\r\n    tools=[get_stock_price, place_trade],\r\n    # The agent can read\/write files under this folder via the file_access_* tools.\r\n    file_access_store=FileSystemAgentFileStore(\"working\"),\r\n)<\/code><\/pre>\n
    Amongst others, the agent now has six tools – file_access_read_file<\/code>, file_access_save_file<\/code>, file_access_list_files<\/code>, file_access_list_subdirectories<\/code>, file_access_search_files<\/code>, and file_access_delete_file<\/code> – and we include the following instructions to tell it how<\/em> to use them:<\/p>\n
    The user’s holdings live in a file called portfolio.csv. Read it before answering questions about their portfolio, and never modify it unless asked. When asked for a report, write it to a Markdown file (e.g. reports\/portfolio-review.md) and tell the user where you saved it.<\/p><\/blockquote>\n
    Now “What’s in my portfolio?”<\/em> reads real rows, and “Write me a portfolio report and save it”<\/em> produces a file you can open.<\/p>\n
    Gate risky actions: approvals<\/h2>\n
    Reading data is often safe. Placing a trade<\/em> is never safe – that’s an action with consequences, and the agent should never take it without a human’s say-so. The harness has a built-in approval<\/strong> mechanism: mark a tool as approval-required, and the agent will pause and ask<\/em> before the tool ever runs.<\/p>\n
    We add a place_trade<\/code> tool (it only simulates the order). In .NET<\/strong>, wrap it in an ApprovalRequiredAIFunction<\/code>:<\/p>\n
    public static AIFunction CreatePlaceTradeTool() =>\r\n    new ApprovalRequiredAIFunction(AIFunctionFactory.Create(PlaceTrade, \"place_trade\"));<\/code><\/pre>\n
    In Python<\/strong>, set approval_mode<\/code> on the @tool<\/code> decorator:<\/p>\n
    from agent_framework import tool\r\n\r\n@tool(approval_mode=\"always_require\")\r\ndef place_trade(symbol: str, action: str, quantity: int) -> str:\r\n    \"\"\"Place a (simulated) buy or sell order.\"\"\"\r\n    ...<\/code><\/pre>\n
    When the model decides to call place_trade<\/code>, the harness emits an approval request<\/em> instead of running the function, and the shared console surfaces it as an Approve \/ Deny<\/strong> prompt. (The planning observers we wired up in Part 1 already include a tool approval observer, so there’s nothing extra to add.) Approve and the trade runs; deny and the agent adapts.<\/p>\n
    Don’t ask again: always-approve<\/h3>\n
    Approving the same<\/em> tool over and over is its own kind of friction. The harness has built-in support for standing approvals<\/strong> – “don’t ask me again” decisions – so once you trust a call, you won’t be pestered for it again. There are two flavours:<\/p>\n