AI Agents & Agentic Workflows in .NET 10 | Complete Developer Guide

Skills Tutorials • Complete Developer Learning Guide

AI Agents & Agentic Workflows

Understand how AI agents reason, use tools, retain context and collaborate through controlled workflows. Build practical, secure agentic applications with modern .NET — from a first agent to production-ready orchestration.

.NET 10 LTSC# 14ASP.NET CoreMicrosoft Agent FrameworkBeginner to Advanced

01. Introduction to Agentic AI

Traditional applications follow instructions written by developers. A user submits a request, application code validates it, business logic runs, and the application returns a result. Generative AI adds another capability: a model can interpret natural language, work with context and produce useful responses. Agentic AI takes this further by allowing an AI-powered system to choose and coordinate actions to reach a goal.

For example, a support application could simply answer, “How do I reset my password?” An agentic support system could classify the request, look up the relevant account policy, check whether the user is eligible, create a support ticket when needed and summarize the result. Each action still needs defined permissions and application-side controls.

Agentic systems add model-guided decisions and tool use around normal application services.

Core idea: An agent does not replace your application architecture. It operates inside it. Your .NET services, database constraints, authorization policies and audit trail remain essential.

02. What Is an AI Agent?

An AI agent is a software system that uses an AI model and a set of available capabilities to work toward an objective. It receives a goal, interprets the request, decides whether more information or an action is needed, uses approved tools and returns or continues based on the result.

An agent may be simple: one model call with a small set of tools. It may also be part of a larger system with persistent conversation state, retrieval, multiple specialized agents and workflow orchestration. Autonomy is a design choice, not a requirement that every agent must operate without supervision.

Common capabilities

Reasoning: interpret a request and select a next step.
Tool use: call application functions, APIs or MCP tools.
Context: use conversation history and relevant business information.
Planning: break a goal into smaller tasks when appropriate.
Adaptation: use tool results to decide what to do next.

A model response that sounds confident is not proof that an action succeeded. Verify important results against the system of record.

03. Agent vs Chatbot vs Workflow

Concept	How it works	Best suited for
Chatbot	Primarily responds to user messages, often through a fixed conversational pattern.	FAQs, guided help, simple conversational interfaces.
AI agent	Uses a model to choose actions, call tools and adapt to tool results.	Open-ended tasks that need decisions and controlled tool use.
Workflow	Executes defined steps, conditions and transitions.	Repeatable business processes with explicit control.
Agentic workflow	Combines defined workflow structure with agents in selected reasoning steps.	Complex processes that need both flexibility and predictable execution.

Use ordinary code when a deterministic function solves the problem. Use a workflow when the steps are known. Use an agent when the task genuinely benefits from language understanding or model-guided decisions. Most production systems combine these approaches.

04. Anatomy of an Agent

An agent is easier to design when its responsibilities are separated into clear components. The model is only one part of the system.

The application owns policy and tool execution. The model proposes actions; trusted code decides whether they are allowed.

Component responsibilities

Model: interprets input and generates decisions or content.
Instructions: define the agent's role, task and boundaries.
Tools: expose narrowly scoped operations.
Context provider: supplies relevant facts and prior state.
Runtime: manages invocation, tool calls and conversation state.
Guardrails: enforce permissions, approval, limits and validation.

05. How an Agent Executes a Task

A common tool-using agent loop is iterative. The model can return a normal answer or request a tool. The runtime validates the request, executes the tool if permitted, sends the result back to the model and continues until the agent finishes or a configured limit is reached.

The loop is bounded by tool permissions, maximum turns, timeouts and application policy.

Not every request needs a tool. A well-designed agent can answer directly when the task is informational, and can decline or ask a clarifying question when the requested action is outside its scope.

06. LLMs, Tokens and Context

A large language model (LLM) predicts and generates content based on its input and learned parameters. It does not automatically know the latest state of your database or business systems. To answer using current application data, provide relevant context through tools, retrieval or other controlled integrations.

Important terms

Term	Meaning	Developer impact
Token	A unit of text or multimodal input processed by a model.	Input and output token use affects context limits, latency and cost.
Context window	The maximum amount of input and output context a model can handle for a request.	Long histories may need summarization or selective retrieval.
Temperature	A sampling control that can affect response variability, where supported.	Use settings appropriate to the task; it does not guarantee factuality.
Embedding	A numerical representation of content used for similarity-based retrieval.	Can support semantic search and retrieval-augmented generation.
Structured output	Output constrained to a defined schema, where supported.	Useful for typed application boundaries; still validate business rules.

A model's knowledge and your application's live data are different things. Use an authoritative data source for balances, permissions, order status, inventory and other facts that can change.

07. Tools and Function Calling

A tool is a function or external capability that an agent can request. Examples include searching a product catalogue, retrieving an order, creating a support ticket or checking a policy. Function calling is the structured interaction through which a model requests one of the tools made available to it.

The model generally chooses a tool and supplies arguments. Your application is responsible for validating those arguments, checking the caller's permissions and deciding whether execution is allowed.

Treat tool calls as untrusted requests until the application validates and authorizes them.

Good tool design

Give each tool one clear responsibility and a precise description.
Use typed arguments and validate ranges, formats and required values.
Return concise, structured results rather than entire database records.
Make read-only tools the default; gate write operations behind explicit policy.
Never expose raw SQL execution, unrestricted shell access or arbitrary internal URLs.

08. Agent Instructions and Prompt Design

Instructions define the agent's role, objective, available capabilities and limits. They should be specific enough to guide behavior but should not be treated as a security boundary. Authorization belongs in code and infrastructure.

Example instruction design

You are the Support Operations Assistant.

Goal:
- Help an authenticated employee understand support requests.
- Use the approved ticket lookup tool for current ticket status.
- Ask for a ticket number when it is missing.

Boundaries:
- Never reveal another employee's private ticket details.
- Do not create, close or modify a ticket without the required approval.
- Do not invent ticket status or policy details.
- If a tool fails, explain that the information could not be verified.

Response:
- Be concise.
- Separate verified facts from suggestions.

Keep prompts versioned and test them with representative inputs. Avoid putting secrets, access tokens or sensitive customer records in instructions.

09. State, Threads and Memory

Conversation state is information needed to continue an interaction. A thread or session commonly groups messages and runtime state for a conversation. Memory is a broader term for information retained or retrieved to help future interactions. These concepts should not be confused with a model permanently learning from a user's chat.

Memory type	Example	Typical storage
Turn context	Messages in the current request.	In-memory request context.
Conversation history	Earlier messages in the same support session.	Database or agent session store.
Application state	Current ticket ID, workflow status or approval state.	Relational database or workflow state store.
Long-term knowledge	Approved documentation or indexed policies.	Document store and/or vector search.
User preferences	Explicitly saved response preferences.	Permission-controlled profile store.

Do not store every conversation detail indefinitely. Define retention, access controls, deletion behavior and data minimization rules. Retrieve only the context needed for the current task.

10. RAG and Knowledge Grounding

Retrieval-Augmented Generation (RAG) is a pattern in which an application retrieves relevant information from an external knowledge source and provides it to a model as context. It helps an agent answer using organization-specific information without assuming that the model already knows it.

RAG supplements model context with retrieved content; it does not guarantee that every answer is correct.

Typical RAG stages

Ingest source documents and extract text and metadata.
Split content into meaningful chunks while preserving useful context.
Generate embeddings and index the chunks in a compatible search system.
At query time, retrieve relevant chunks using semantic, keyword or hybrid search.
Apply document-level authorization and pass selected content to the model.
Ask the model to answer from the supplied evidence and expose citations where possible.

For .NET applications, the storage choice may be Azure AI Search, PostgreSQL with pgvector, SQL Server capabilities where appropriate, or another supported vector/search provider. Select based on scale, filtering, operational skills and data residency requirements.

11. Model Context Protocol (MCP)

Model Context Protocol (MCP) is an open protocol for connecting AI applications to external tools and context sources through a standardized interface. An MCP server can expose tools, resources or prompts. An MCP client connects to that server and makes its capabilities available to an AI application.

MCP standardizes capability connections; it does not automatically make a connected tool safe.

MCP is useful when multiple AI clients need consistent access to the same tools or resources. Treat each server as an external integration: authenticate it, restrict capabilities, validate inputs, log calls and review data-sharing implications.

12. Agentic Workflow Fundamentals

A workflow defines how work moves from one step to another. A traditional workflow may use only deterministic code. An agentic workflow inserts one or more model-driven steps where flexible interpretation or decision-making is useful.

For example, a document review process can have deterministic steps for file validation, storage and audit logging, while an agent extracts key clauses and another agent summarizes potential issues. A human reviewer approves any consequential decision.

Workflow building blocks

Step / executor: performs a defined unit of work.
Edge: routes output to the next step.
Condition: selects a path based on a result.
State: carries required information between steps.
Event: reports workflow progress or requests input.
Checkpoint: captures progress so a supported workflow can resume.

13. Orchestration Patterns

Choose an orchestration pattern based on how responsibilities and outputs relate. More agents do not automatically mean better results.

Simplified conceptual diagrams. Use explicit routing, limits and result contracts in real implementations.

Pattern	How it works	Good fit	Watch out for
Sequential	Each agent receives output from the previous step.	Research → draft → review.	Accumulated context and latency.
Concurrent	Independent agents run in parallel; results are combined.	Independent reviews or translations.	Conflicting results and aggregation quality.
Handoff	One agent transfers control to a specialist.	Support triage to billing or technical support.	Routing loops and unclear ownership.
Group chat	Agents collaborate in a shared conversation.	Tasks where iterative discussion is useful.	Unbounded discussion and token cost.
Manager-led / Magentic	A coordinator delegates and tracks subtasks.	Open-ended tasks requiring dynamic decomposition.	Harder control, testing and cost predictability.

14. Microsoft Agent Framework

Microsoft Agent Framework (MAF) is Microsoft's open-source framework for building AI agents and multi-agent workflows in .NET and Python. Its documented capabilities include agents, tools, MCP integration, sessions, context providers, middleware, workflow orchestration and hosting integrations. Microsoft positions it as the successor direction combining ideas from Semantic Kernel and AutoGen.

For current .NET development, learn the framework's core concepts: AIAgent, agent sessions, function tools, workflow builders, executors, events, middleware and integrations. The framework is evolving; package versions and APIs may change. Verify the exact package and API version in the official docs before copying a sample into production.

Version note (15 November 2026): .NET 10 is the current LTS baseline for this guide. Microsoft Agent Framework documentation currently shows some .NET installation flows using prerelease packages, such as Microsoft.Agents.AI.Foundry --prerelease. Treat those framework APIs as version-sensitive and confirm release status before production adoption. .NET 11 is newer but is an STS release, not the LTS baseline used here.

Where it fits

Agents: model-powered systems with instructions, tools and session state.
Workflows: graph-based execution paths that connect agents and custom executors.
Integrations: model providers, MCP, context, middleware and hosting.
Human-in-the-loop: pause for review or approval when a step needs human authority.

15. .NET AI Building Blocks

Modern .NET AI applications can use a layered approach. Microsoft.Extensions.AI provides common abstractions such as IChatClient and IEmbeddingGenerator<TInput,TEmbedding>. Provider-specific libraries connect those abstractions to a model service. Higher-level agent frameworks add agent runtime and orchestration features.

Layer	Examples	Responsibility
Application	ASP.NET Core, Minimal APIs, background services	HTTP endpoints, identity, validation and business rules.
Agent orchestration	Microsoft Agent Framework	Agent execution, tools, sessions and workflows.
AI abstractions	Microsoft.Extensions.AI	Provider-neutral chat and embedding interfaces, middleware.
Model provider	Microsoft Foundry, Azure OpenAI, OpenAI, other supported providers	Model inference and provider capabilities.
Data and retrieval	EF Core, SQL Server, Azure AI Search, vector stores	Business data, documents, retrieval and state.
Operations	OpenTelemetry, logs, metrics, tracing	Visibility into requests, tool calls and workflow behavior.

Prefer abstractions at application boundaries where they provide value, but do not hide provider-specific features that your product depends on. Keep provider credentials and model configuration outside source code.

16. Create Your First .NET Agent

Start with a .NET 10 console application or ASP.NET Core project. Install the .NET 10 SDK and create a project:

dotnet new console -n FirstAgent
cd FirstAgent

For the Microsoft Foundry-backed Agent Framework quickstart, the current documentation demonstrates this package installation pattern:

dotnet add package Microsoft.Agents.AI.Foundry --prerelease

Example based on the documented C# quickstart pattern. Configure a Foundry project endpoint and model deployment in environment variables; use your own values rather than embedding credentials in source.

using Azure.AI.Projects;
using Azure.Identity;
using Microsoft.Agents.AI;

var endpoint = Environment.GetEnvironmentVariable(
    "FOUNDRY_PROJECT_ENDPOINT")
    ?? throw new InvalidOperationException(
        "FOUNDRY_PROJECT_ENDPOINT is missing.");

var model = Environment.GetEnvironmentVariable("FOUNDRY_MODEL")
    ?? throw new InvalidOperationException(
        "FOUNDRY_MODEL is missing.");

AIAgent agent = new AIProjectClient(
        new Uri(endpoint),
        new AzureCliCredential())
    .AsAIAgent(
        model: model,
        instructions: "You are a helpful developer assistant. " +
                      "Explain concepts clearly and do not invent facts.");

var result = await agent.RunAsync(
    "Explain dependency injection in ASP.NET Core.");

Console.WriteLine(result);

This is a provider-specific getting-started pattern, not a promise that every model provider uses the same constructor. Check the current Agent Framework provider integration page and package version. For local development, Azure CLI credentials can be convenient; production should use an explicitly configured managed identity or other approved credential.

17. Add Tools to a .NET Agent

Tools connect the agent to capabilities implemented by your application. In Agent Framework examples, a C# method can be exposed with descriptive metadata and registered using AIFunctionFactory.Create.

using System.ComponentModel;

[Description("Find a support ticket by its public ticket number.")]
static async Task<string> FindTicketAsync(
    [Description("The ticket number supplied by the user.")]
    string ticketNumber)
{
    // Call an application service here.
    // Validate the ticket number and enforce caller permissions.
    return await ticketService.GetSafeSummaryAsync(ticketNumber);
}

AIAgent agent = projectClient.AsAIAgent(
    model: modelName,
    instructions: "Use the ticket lookup tool for current ticket status. " +
                  "Do not guess when no ticket is found.",
    tools: [AIFunctionFactory.Create(FindTicketAsync)]);

var answer = await agent.RunAsync(
    "Can you check ticket ST-1042?");

The snippet illustrates the registration pattern; projectClient, modelName and ticketService represent dependencies configured by your application. The tool implementation must enforce tenant scope and user authorization before returning data.

Read and write tools should be treated differently

Tool type	Example	Control
Read-only	Get order status	Authenticate, authorize and filter returned fields.
Low-risk write	Add an internal note	Validate input and record audit details.
High-impact write	Issue refund, change payroll or delete data	Explicit approval, policy checks and idempotency.

18. Build an Agentic ASP.NET Core API

In a web application, the agent should sit behind a normal application boundary. The API authenticates the caller, validates the request, loads only authorized context and invokes the agent service. Do not let the model become the authentication or authorization layer.

The API owns identity and request policy; application services own business operations and data access.

19. Multi-Agent Systems

A multi-agent system assigns distinct responsibilities to separate agents. One agent might classify a support request, another retrieve policy information and a third draft a response. A workflow or coordinator controls how their outputs are passed along.

Specialization is useful when the responsibilities require different instructions, tools, context or review criteria. It is not useful when several agents merely repeat the same prompt and produce redundant opinions.

Design principles

Give each agent a narrow role and an explicit input/output contract.
Keep shared state outside agent messages when it must be authoritative.
Define which agent may call which tools.
Set limits for delegation depth, retries, time and total model calls.
Validate agent output before passing it into a consequential action.

20. Human-in-the-Loop and Approvals

Human-in-the-loop (HITL) means a person reviews, supplies information or approves a step before the workflow continues. It is especially important for actions that affect money, customer accounts, employment records, legal commitments or production systems.

Approval should be enforced by the workflow or tool handler, not merely requested in a prompt.

Record who approved, what was approved, the exact arguments, when approval occurred and whether the action completed. Re-check authorization at execution time because permissions or business state may have changed after approval.

21. Agent Security and Guardrails

Agentic systems introduce risks because model-generated tool requests can trigger real operations. Apply the same security discipline used for any application that handles untrusted input, external services and privileged actions.

Security controls

Authentication: identify the user or service calling the API.
Authorization: enforce RBAC, claims, tenant and resource-level access in trusted code.
Least privilege: give each tool only the permissions it needs.
Input validation: validate tool arguments, lengths, identifiers and business constraints.
Prompt-injection defense: treat retrieved documents and tool output as untrusted data, not instructions.
Data protection: redact secrets and minimize sensitive data sent to model providers.
Approval gates: require confirmation for high-impact actions.
Auditability: log identity, tool name, decision, approval and outcome without logging secrets.

Never rely on a system prompt to enforce access control. A malicious or confused model can still request a tool. The tool handler must independently verify whether the authenticated caller is allowed to perform the action.

22. Reliability, Retries and Idempotency

Model calls and external tools can fail, time out, return incomplete data or produce malformed output. A production agent needs normal distributed-systems engineering: timeouts, cancellation, bounded retries, circuit breaking where appropriate, durable state and idempotent operations.

Concern	Recommended approach
Timeout	Set separate limits for model calls and tool calls; propagate cancellation tokens.
Retry	Retry transient failures with bounded backoff; avoid retrying permanent validation errors.
Duplicate action	Use idempotency keys and unique operation IDs for side-effecting tools.
Partial workflow failure	Persist progress and define compensating actions where required.
Malformed model output	Validate against a schema and handle invalid results explicitly.
Looping behavior	Set maximum steps, tool calls, delegation depth and overall execution time.

For long-running processes, consider durable workflow infrastructure rather than keeping an HTTP request open while an agent works. Return a job identifier and expose status updates when the task naturally takes longer than an interactive request.

23. Observability and Evaluation

Logging only the final answer is not enough to understand an agent. You need visibility into model requests, tool calls, workflow steps, latency, token usage, errors and approval decisions. Use correlation identifiers to connect the user request to all downstream operations.

Useful operational signals

Request count, success rate, failure rate and cancellation rate.
Model latency, tool latency and total workflow duration.
Token usage and estimated cost by feature or tenant.
Tool selection frequency, validation failures and approval outcomes.
Retrieval relevance, citation coverage and grounded-answer quality.
Human escalation rate and task completion rate.

Use OpenTelemetry-compatible instrumentation where supported by your AI client and agent runtime. Avoid logging full prompts or responses by default when they may contain personal or confidential data. Define sampling, redaction and retention rules.

24. Testing Agentic Applications

Agent testing is not just checking whether the model returns a plausible paragraph. Test deterministic boundaries with normal .NET tests, then evaluate model behavior with representative datasets and explicit quality criteria.

Test level	What to verify
Unit tests	Tool validation, authorization, domain rules, prompt assembly and output parsing.
Integration tests	Provider connectivity, database behavior, retrieval filters and tool execution.
Workflow tests	Routing, retries, approval pauses, failure branches and resume behavior.
Evaluation tests	Task success, factual grounding, refusal behavior and tool selection quality.
Security tests	Cross-tenant access, prompt injection, unauthorized actions and data leakage.

Use a fixed evaluation set with expected outcomes and regression thresholds. Because model outputs can vary, prefer semantic and task-based assertions over brittle exact-string matching.

25. Data, Vector Stores and Persistence

Choose storage according to the kind of information being stored. Business records, conversation history, workflow state and semantic document indexes have different consistency and query requirements.

Data	Possible storage	Design note
Business records	SQL Server / relational database	Keep the authoritative source of truth here.
Conversation metadata	Relational or document database	Partition by user/tenant and apply retention rules.
Workflow state	Durable workflow store	Persist checkpoints and operation identifiers.
Document content	Blob/object storage	Store original documents with access controls.
Embeddings and search index	Vector-capable search service	Keep metadata filters and permission checks aligned with source documents.

Do not treat a vector index as the source of truth for mutable business facts. Reconcile indexes when source documents change, and ensure retrieval applies the same tenant and document permissions as the application.

26. Deployment and Production Architecture

A .NET agent can be hosted in an ASP.NET Core API for interactive use, a background worker for asynchronous tasks, or a durable workflow host for long-running processes. Select hosting based on execution duration, concurrency, state requirements and operational needs.

A production design separates user-facing APIs, agent execution, data access and operational telemetry.

Deployment considerations

Use managed identity or a secrets vault for credentials.
Keep model endpoints, deployment names and limits in configuration.
Apply network restrictions and private connectivity where required.
Scale stateless API instances separately from long-running workers.
Persist state outside process memory when continuity is required.
Use health checks, deployment slots or staged rollouts and rollback plans.
Review data residency, provider retention and compliance obligations.

27. Cost, Latency and Performance

Agentic systems can make multiple model calls and tool calls for one user request. Cost and latency therefore depend on the workflow, not just the selected model.

Use smaller or faster models for classification and simple extraction when quality is sufficient.
Limit the number of agent turns and tool calls.
Retrieve only relevant context; avoid sending entire documents or long histories.
Cache stable, non-sensitive results where freshness rules permit.
Run independent tasks concurrently when safe and when the provider supports the workload.
Use streaming for interactive responses when appropriate.
Measure end-to-end latency and cost per completed business task.

A more expensive model or multi-agent design is justified only when it measurably improves task outcomes enough to offset the added cost, latency and operational complexity.

28. Common Mistakes and Troubleshooting

Problem	Likely cause	What to check
Agent invents current business status	No authoritative lookup was performed.	Require a tool for mutable facts and verify tool results.
Tool is called with invalid arguments	Model-generated arguments were trusted directly.	Validate types, ranges, formats and business constraints.
Unauthorized data is returned	Authorization was only described in prompt instructions.	Enforce identity and resource access inside the tool/service.
Agent repeats a tool call	Unclear tool result or missing loop bounds.	Return explicit outcomes and cap turns/retries.
High token cost	Too much history, retrieved content or agent delegation.	Trim context, summarize history and simplify orchestration.
Workflow stops after restart	State existed only in process memory.	Use persistent sessions/checkpoints or durable execution.
RAG returns irrelevant documents	Weak chunking, embeddings or metadata filters.	Evaluate retrieval quality and enforce document permissions.
Provider package sample does not compile	API or package version differs from the sample.	Pin compatible versions and follow the current provider docs.

29. Practical Project: Support Operations Agent

Build a support assistant that can explain policies and retrieve a ticket summary for the authenticated employee. Keep the first version intentionally narrow. Do not begin with a fully autonomous multi-agent system.

Functional requirements

Accept a natural-language support question through an ASP.NET Core endpoint.
Authenticate the caller and resolve their employee identity.
Use a policy retrieval tool to find relevant approved guidance.
Use a ticket lookup tool that enforces employee and tenant access.
Return a concise response with verified ticket details and policy references.
Require human approval before any ticket update or other write action.
Record tool calls, workflow outcomes and approval decisions.

Suggested project contracts

public sealed record SupportQuestionRequest(
    string Question,
    string? TicketNumber);

public sealed record SupportAnswerResponse(
    string Answer,
    IReadOnlyList<string> Sources,
    bool RequiresHumanReview);

public interface ISupportAgentService
{
    Task<SupportAnswerResponse> AskAsync(
        string employeeId,
        SupportQuestionRequest request,
        CancellationToken cancellationToken);
}

Implementation milestones

Milestone	Deliverable
1. Basic assistant	Agent responds to general support questions with clear boundaries.
2. Ticket tool	Read-only lookup with server-side employee authorization.
3. Policy RAG	Retrieval from approved policy documents with source references.
4. Session persistence	Conversation continuity with ownership and retention controls.
5. Approval workflow	Human review for ticket changes and sensitive actions.
6. Production readiness	Tests, telemetry, rate limits, cost limits and deployment.

Success criteria: the assistant never exposes another employee's ticket, does not invent current ticket status, cites the policy content it used and cannot perform a write operation without the required approval.

30. Best Practices and Design Checklist

Start with a business problem, not with a multi-agent architecture.
Prefer deterministic application code for deterministic operations.
Keep agent roles and tool descriptions narrow and explicit.
Use typed contracts and validate all model-generated arguments.
Enforce authorization in trusted services, never only in prompts.
Use retrieval for private or frequently changing knowledge.
Minimize context and apply data retention rules.
Require approval for high-impact or irreversible actions.
Bound model turns, tool calls, retries, time and cost.
Persist state for long-running work and design for recovery.
Instrument model calls, tool calls and workflow transitions.
Evaluate quality, safety and task completion continuously.
Pin package versions and verify evolving framework APIs.
Benchmark the complete workflow, not only a single model call.

31. Interview Questions and Answers

1. What is an AI agent?

An AI-powered system that works toward an objective using a model, context and available tools. It can choose actions based on the task and the results it receives.

2. What is agentic AI?

It is an approach in which AI systems can plan or select steps and use tools to accomplish goals, within boundaries defined by the application.

3. What is the difference between an agent and a workflow?

An agent uses model-guided decisions for open-ended tasks. A workflow defines explicit steps and routing. An agentic workflow combines both.

4. What is function calling?

It is a structured mechanism through which a model requests an application-defined function with arguments. The application validates and executes the function.

5. What is RAG?

Retrieval-Augmented Generation retrieves relevant external content and supplies it to a model as context so the response can be grounded in that content.

6. What is an embedding?

An embedding is a numerical representation of content used to compare semantic similarity and support retrieval.

7. What is MCP?

Model Context Protocol is an open protocol for connecting AI applications to external tools and context sources through a standardized interface.

8. What is the difference between conversation state and long-term memory?

Conversation state supports a current interaction or thread. Long-term memory is selected information retained or retrieved across interactions under explicit storage and privacy rules.

9. What is multi-agent orchestration?

It coordinates multiple specialized agents through patterns such as sequential execution, concurrent execution, handoff, group chat or manager-led delegation.

10. What is human-in-the-loop?

It is a design in which a person reviews, supplies input or approves an action before a workflow continues.

11. How do you secure an agent's tools?

Use least privilege, authenticated identity, server-side authorization, input validation, approval gates, audit logs and restricted tool capabilities.

12. Why should an agent not directly execute arbitrary SQL?

Arbitrary SQL can bypass business rules and expose or modify data. Expose narrowly scoped application services with parameterized queries and authorization instead.

13. How do you test an agent?

Unit-test deterministic tool logic, integration-test provider and data access, test workflow branches, and evaluate model behavior with representative datasets and quality metrics.

14. How do you make long-running agents reliable?

Persist sessions and workflow state, use checkpoints or durable execution, bound retries, make side effects idempotent and design explicit recovery paths.

15. What is Microsoft Agent Framework?

It is Microsoft's framework for building agents and multi-agent workflows in .NET and Python, with tools, sessions, workflows, integrations and operational capabilities.

16. When should you avoid using an agent?

When a simple function, query, rules engine or deterministic workflow solves the requirement more clearly, cheaply and reliably.

32. Official Documentation and Further Learning

Use official documentation as the source of truth for package versions, provider support, API signatures and production guidance. Agent frameworks and model integrations evolve quickly, so verify examples against the version you install.

Learning recommendation: First understand the model/tool loop and secure tool boundaries. Then add conversation state and RAG. Move to multi-agent workflows only when the use case benefits from explicit coordination.

33. Final Thought

AI agents are not simply chatbots with more complicated prompts. They are application components that combine model reasoning with tools, context, state and controlled execution. Their value comes from helping software handle tasks that involve interpretation and flexible decisions — while reliable application code remains responsible for permissions, business rules and real-world side effects.

As a .NET developer, you do not need to abandon the foundations you already know. ASP.NET Core, dependency injection, EF Core, SQL Server, authentication, background services, observability and clean architecture are still central. Agentic AI adds a new capability layer that should fit into those foundations rather than bypass them.

Skills Tutorials – Learn • Build • Grow Together

Programming