https://thedotnetblog.com/tags/approvals/Articles, tutorials and insights from the .NET community.Hugoen@thedotnetblog (The .NET Blog)@thedotnetblogSat, 11 Jul 2026 00:00:00 +0000https://thedotnetblog.com/news/emiliano-montesdeoca/agent-harness-safe-data-access-patterns/Sat, 11 Jul 2026 00:00:00 +0000Emiliano Montesdeocahttps://thedotnetblog.com/news/emiliano-montesdeoca/agent-harness-safe-data-access-patterns/File access, approvals, and memory design are the practical triad for trustworthy agent behavior in production.<p>Original source: <a href="https://devblogs.microsoft.com/agent-framework/agent-harness-working-with-your-data-safely/">Agent Harness: Working with your data, safely</a></p> <p>This is one of the more useful agent engineering posts this year because it refuses the common trap of demo-first autonomy. Instead, it focuses on how agents should operate around real user data and real consequences.</p> <p>The three building blocks highlighted here are exactly right.</p> <ul> <li><strong>File access</strong> gives agents useful grounding in user-owned data.</li> <li><strong>Approval gating</strong> prevents silent execution of consequential actions.</li> <li><strong>Durable memory</strong> avoids repetitive interactions without sacrificing control.</li> </ul> <p>Most teams overinvest in tool breadth and underinvest in permission semantics. That is backward. An agent with ten tools and weak approval boundaries is less valuable than an agent with three tools and predictable control points.</p> <p>The best practical pattern in this article is <strong>layered approval strategy</strong>:</p> <ul> <li><strong>Always require approval</strong> for high-impact tools like trading or destructive operations.</li> <li><strong>Auto-approve</strong> low-risk reads to preserve flow.</li> <li><strong>Use scoped standing approvals</strong> for repetitive trusted actions within a session.</li> </ul> <p>This creates a healthy risk gradient. Users are not interrupted for harmless reads, but they are still in the loop when consequences become expensive or irreversible.</p> <p>I also like the explicit split between <strong>file memory</strong> and <strong>Foundry memory</strong>. Teams should stop trying to force one memory model to solve every problem. Coarse, explicit file artifacts are excellent for user-visible state like reports and watchlists. Fact-level memory extraction is better for preferences and conversational context. Mixing both gives better outcomes than trying to pretend either one is sufficient.</p> <p>My opinionated take: the future of agent quality will be measured less by clever prompts and more by <strong>safety ergonomics</strong>. If your approval prompts are noisy, users click through blindly. If your memory boundaries are unclear, users stop trusting the assistant. If your data access defaults are permissive, security teams will shut the project down.</p> <p>For .NET and Python teams adopting this pattern, the key move is to <strong>treat policy callbacks and approval rules as core business logic</strong>, versioned and tested like any other critical code. Do not leave them as ad-hoc lambdas buried in samples.</p> <h2 id="the-bottom-line">The bottom line</h2> <p>Agent systems that earn trust are not the ones that do the most. They are the ones that do exactly what users intended, no more, no less, with clear interruption points when risk rises.</p> <p>That is the difference between an impressive demo and software people are willing to delegate real work to.</p>