Microsoft AutoGen

Pavri integrates with Microsoft AutoGen through a middleware hook that enforces runtime governance policies on function calls.

One-Line Integration

from pavri import PavriConfig, secure

agent = build_autogen_agent()
agent = secure(agent, PavriConfig(agent_name="my-agent", plugin="autogen"))

The secure() call attaches the Pavri runtime to the agent, registers it with the backend, and installs the enforcement hook.

Supported Versions

• AutoGen >=0.4.0
• Python >=3.12

How It Works

Plugin Detection

The AutoGenAdapter matches when either:

• You pass plugin="autogen" in the config
• The target object's module name contains "autogen"

Hooks Attached

When the runtime has an active policy cache and telemetry emitter, secure() attaches the following hook:

Hook	Purpose
_pavri_middleware	Evaluates policy before function call execution; raises PolicyDeniedError on denial

Middleware Enforcement

The _pavri_middleware hook is called with the tool name before each function call:

# Internal flow — you do not call this directly
agent._pavri_middleware("tool_name")

The hook calls enforce_policy(f"tool:{tool_name}", ctx) against the local policy cache. This follows the FunctionCallMiddleware pattern where the middleware can intercept and short-circuit tool execution.

Policy evaluation respects the configured fail_mode:

• fail-open (default): If policy evaluation fails, the function call is allowed.
• fail-closed: If policy evaluation fails, the function call is denied.

When a policy rule denies the action, PolicyDeniedError is raised:

from pavri.core.exceptions import PolicyDeniedError

try:
    result = await agent.run(task)
except PolicyDeniedError as e:
    print(f"Blocked: {e.reason} (rule: {e.rule_id})")

Configuration

Key PavriConfig options for AutoGen:

from pavri import PavriConfig

config = PavriConfig(
    agent_name="my-agent",
    plugin="autogen",
    api_key="fab_...",
    backend_url="https://pavri.example.com",
    org_id="org-acme",
    session_id="session-123",
    team="platform",
    environment="production",
    fail_mode="open",
)

Field	Default	Description
fail_mode	"open"	Whether to allow or deny when policy evaluation fails
telemetry_mode	"full"	Controls telemetry detail level
environment	"development"	Deployment environment tag
policy_sync.poll_interval_seconds	60	How often to poll for policy updates

AutoGen Architecture Notes

AutoGen has unique capabilities for agent-to-agent governance through its MiddlewareAgent pattern. The design spec identifies AutoGen as the only framework with deep interception of agent-to-agent messages. The current Pavri integration provides function-call-level enforcement; the following are planned for future releases:

• MiddlewareAgent wrapping for message interception between agents in GroupChat
• Agent message hooks for monitoring agent-to-agent communication
• Post-tool telemetry for execution result capture
• Docker execution monitoring to detect when use_docker=False disables sandboxing

Graceful Degradation

If the Pavri runtime cannot build an enforcement context, the plugin skips hook installation entirely. The agent runs without Pavri enforcement. Check the runtime status to verify:

from pavri.core import get_runtime

runtime = get_runtime(agent)
status = runtime.status()
print(status.connected, status.policy_revision)

Troubleshooting

Agent runs but no policy enforcement

• Verify the backend is reachable and api_key is set.
• Check runtime.status().policy_revision — if 0, the SDK has no cached policy.
• The plugin requires both a policy cache and telemetry emitter.

PolicyDeniedError raised unexpectedly

• Inspect the exception: e.decision contains the full PolicyDecision with the matched rule_id and reason.
• Check whether fail_mode="closed" is set.
• Review policies in the dashboard.

Plugin not detected

• Pass plugin="autogen" explicitly in the config.
• Ensure the agent object's module includes "autogen" in its path for auto-detection.

What's Deferred

The following capabilities are planned for Phase 2:

• Log forwarding from the AutoGen plugin
• Trace-link capture for AutoGen tracing
• MiddlewareAgent wrapping for agent-to-agent message interception
• Agent message hook for content monitoring and truncation
• Post-tool telemetry with trace capture
• GroupChat-level guardrail integration