Governed AI orchestration in application code

Embed Semantic Kernel reasoning in workflows that stay under business control

Connect approved model services to narrow business functions without turning the model into the system of authority. MetaCTO uses Semantic Kernel to package prompts and plugins, filter every invocation, route consequential action requests to review, and return verified results to the service that owns the work.

Context boundary
Each run receives only the records, functions, and model service required for its case
Action boundary
Plugin calls remain requests until trusted application code authorizes their effects
Operating evidence
Function traces, reviewer decisions, write receipts, and final outcomes share one case ID

Kernel-to-approved-action circuit

Governed
  1. 01
    Open a durable case with actor, purpose, and current state
  2. 02
    Assemble the kernel with an approved AI service and task-specific plugins
  3. 03
    Render a versioned prompt from permission-filtered context
  4. 04
    Let function calling select from the functions allowed for this step
  5. 05
    Apply filters, policy checks, and human approval before side effects
  6. 06
    Execute once, capture the receipt, and return status to the case

Responsibility boundary

Use the kernel as a reasoning bridge, not the operating record

Semantic Kernel can bring AI services, prompt functions, native functions, and plugins into one invocation path. The host application must still know who requested the work, what the case permits, whether an action was approved, and whether the destination accepted it.

Specific role

Semantic Kernel mediates model and function interaction inside a service. The application supplies identity and scoped context, enforces business policy, preserves durable process state, authorizes side effects, and owns recovery.

1

Application authority

  • Authenticated actor, role, tenant, purpose, and case ID
  • Current source records, policy versions, and field permissions
  • Durable workflow state, deadlines, and approval requirements
  • Transaction rules, idempotency key, and manual fallback owner
2

Semantic Kernel

  • Configured AI service and prompt execution settings
  • Versioned prompts plus task-specific plugin functions
  • Function choice, argument marshaling, and response assembly
  • Invocation filters, logging hooks, and structured proposal
3

Controlled result

  • Revalidated arguments and destination authorization
  • Reviewer acceptance, correction, rejection, or escalation
  • Scoped write-back with external receipt and reconciliation
  • Outcome signal connected to the prompt and plugin release

A kernel is designed to be lightweight and its plugin collection is mutable. Construct each invocation from the approved service and plugin policy for that workload rather than treating a shared, long-lived kernel as the security boundary.

Framework selection

Choose Semantic Kernel when AI belongs inside enterprise service code

The strongest reason to adopt Semantic Kernel is not access to a model. It is the ability to compose AI services, dependency-injected business functions, prompt templates, and invocation filters in a Microsoft-oriented application while keeping the workflow's authority outside the model loop.

Semantic Kernel is a strong fit when

  • A .NET, Python, or Java service needs a defined layer for prompts, model services, plugins, and function calling.
  • Existing APIs and service dependencies should become narrowly described native, OpenAPI, or MCP-backed functions without exposing unrestricted clients to the model.
  • The engineering team wants filter points around prompt rendering, function invocation, and automatic function calling for policy, logging, validation, or review.
  • The workflow is application-led and the team can own durable state, authorization, retries, audit evidence, deployment, and production support.
  • Microsoft services are important, but the orchestration code should remain separable from the managed model and agent control plane.

Use a different layer when

  • ! Microsoft Foundry is needed to govern model deployments, hosted agent resources, evaluations, projects, and cloud observability as a managed platform.
  • ! Microsoft Agent Framework should be evaluated first for a net-new agent or graph workflow because Microsoft positions it as the direct successor to both Semantic Kernel's agent framework and AutoGen.
  • ! LangChain better fits a broader cross-provider Python or JavaScript ecosystem and its established agent, retrieval, and middleware abstractions.
  • ! A direct model SDK plus ordinary application functions is clearer for one prompt, no tool loop, and a small integration surface.
  • ! A durable orchestrator is required to preserve timers, retries, compensation, and multi-day workflow state through process and service failures.

Compare the options with one representative case. Score plugin ergonomics, authorization placement, state recovery, evaluation, telemetry, team language, model portability, and operational ownership. Do not select an orchestration framework merely to gain access to a model endpoint.

Application-embedded operating workflows

Give model reasoning a narrow job between context and action

These workflows use Semantic Kernel where interpretation helps, then rely on ordinary application services for rules, approvals, transactions, and recovery.

01 Revenue operations

Prepare a renewal-risk action brief

A revenue service gathers the permitted account record, contract obligations, support themes, and product signals. Semantic Kernel invokes read-only plugins to assemble cited risks and propose next steps for the account owner.

  1. Filter fields and records to the assigned account team
  2. Expose only retrieval and draft-generation functions
  3. Validate required evidence and prohibited commitment language
  4. Let the owner approve CRM tasks and outreach separately

Business outcome: A consistent renewal review while commercial authority stays with the account owner

02 Field service

Triage a field-service escalation

The kernel coordinates asset history, recent work orders, warranty policy, and parts availability through case-scoped functions, then returns a structured explanation and resolution options to the service manager.

  1. Resolve the current asset, customer, and territory permissions
  2. Call read-only diagnostic and inventory functions
  3. Flag conflicting evidence and missing service records
  4. Approve appointment, parts, and customer-commitment changes

Business outcome: A faster path from a messy escalation to an owned resolution plan

03 Insurance operations

Assemble an insurance submission review

Prompt and retrieval functions organize authorized submission facts against the effective checklist. The output identifies missing evidence and contradictions without deciding eligibility, coverage, or pricing.

  1. Keep sensitive fields outside context unless required
  2. Preserve document and page provenance for material facts
  3. Apply deterministic completeness rules after extraction
  4. Route exceptions and final judgment to a licensed reviewer

Business outcome: More review-ready cases with human judgment and evidence preserved

04 Distribution operations

Explain a wholesale order exception

The workflow combines order state, stock, shipment events, customer terms, and approved operating rules. Functions return current facts while the model proposes an evidence-backed route for an operations coordinator.

  1. Snapshot the order version before analysis
  2. Limit available functions to the current exception type
  3. Require reason, evidence, uncertainty, and proposed action fields
  4. Recheck order state before any approved ERP update

Business outcome: Clearer exception queues without duplicate or stale order changes

05 IT operations

Draft an internal access-request decision packet

A service retrieves the request, role policy, resource owner, and separation-of-duties evidence. Semantic Kernel prepares a summary and missing-information questions, but an identity system and authorized approver control the grant.

  1. Exclude privilege-grant functions from the model tool set
  2. Check policy and conflicts in deterministic code
  3. Present the exact requested scope and evidence to the approver
  4. Record the decision before a separate service changes access

Business outcome: Better-prepared access reviews without delegating security authority to the model

Define the boundary before the plugin

Decide what the model may request before exposing a business function

Opportunity Mapping identifies one work queue, its measurable baseline, source permissions, allowable functions, review threshold, durable owner, write-back contract, and recovery path before the kernel is assembled.

Kernel-plugin-filter architecture

Turn a model-selected function into an approved business action

Function calling can choose and invoke plugin functions, but model selection is not authorization. Put trusted filters and service checks around the kernel, then keep the final transaction in an independently controlled action service.

Case

Open from durable work

01

Start with a real operational record and an accountable owner.

  • Case ID, current version, authenticated actor, and purpose
  • Permission-filtered source snapshot and effective policy
  • Risk tier, due date, and manual completion path

Kernel

Compose services and prompts

02

Build the task invocation from approved dependencies.

  • Allowed AI service and execution settings
  • Versioned prompt template and structured response contract
  • Only the plugins needed for the current workflow step

Plugin

Offer narrow capabilities

03

Describe inputs, outputs, and side effects so function calling has a precise choice.

  • Read functions separated from write-capable functions
  • Typed arguments and bounded result shapes
  • Native code, OpenAPI, or MCP adapter behind a stable contract

Filter

Inspect every invocation

04

Use prompt, function, and automatic-function filters to observe or stop unsafe execution paths.

  • Prompt redaction and context policy
  • Function allowlist, argument validation, and exception handling
  • Approval handoff for consequential requested actions

Action

Commit through trusted code

05

Reauthorize outside the model path before changing operational state.

  • Freshness, policy, permission, and approval validation
  • Idempotent execution plus destination receipt
  • Reconciliation, outcome monitoring, and audit retention

Semantic Kernel's Process Framework is experimental and its vector-store abstractions remain in preview. Microsoft now positions Agent Framework as the successor for new agent and explicit workflow development. Treat retrieved memory as context rather than an authoritative or durable record, isolate preview capabilities behind replaceable interfaces, confirm current SDK and connector support, and use a proven durable workflow engine or application state store for critical recovery requirements.

Invocation control and production recovery

Observe the reasoning path without trusting it to enforce policy

Semantic Kernel provides filters and, in supported SDKs, OpenTelemetry-compatible logs, metrics, and traces. The host service must decide what is safe to record, which errors may be retried, and whether a requested function can change business state.

Human approval points

  • Require named approval for financial changes, customer commitments, access grants, regulated records, safety actions, and other consequential side effects.
  • Show the source evidence, selected function, proposed arguments, policy result, and affected record before asking for approval.
  • Route low confidence, conflicting sources, missing required context, novel function requests, and policy exceptions to the process owner.
  • Review and approve any expansion in plugin scope, data reach, or autonomous action separately from a prompt-copy change.

Failure handling

  • Retry only failures classified as transient, cap attempts with backoff, and return exhausted work to a visible queue with the last known safe state.
  • When a model or function times out, preserve the case and trace reference, then reconcile the destination before deciding whether execution is safe to repeat.
  • Make write functions idempotent and verify source-record freshness so duplicate delivery or a late approval cannot repeat or overwrite a newer action.
  • If structured output, retrieval, permission, or policy validation fails, stop the dependent action and send the case through its manual completion path.
  • Roll back the prompt, plugin, filter, model-service, and schema release together when evaluation or production outcome signals regress.
1 Scope

Per-case plugin allowlist

Register only functions needed for the current step and actor. Keep broad database clients, credentials, administrative methods, and unrelated plugins out of the kernel.

2 Context

Prompt and context filter

Remove unnecessary sensitive fields, preserve source references, inspect rendered prompts where policy permits, and prevent retrieved instructions from overriding the workflow contract.

3 Tools

Function invocation gate

Inspect selected function, arguments, iteration state, case permissions, and risk tier. Stop or replace a result when validation fails, and never treat filter presence as destination authorization.

4 Quality

Release evaluation

Test prompts, plugin descriptions, function selection, argument quality, refusals, approval routing, denied access, and expected structured output against stable cases before promotion.

5 Trace

Privacy-aware telemetry

Correlate kernel, model, and function telemetry with the case ID while leaving sensitive prompt and response capture disabled unless policy, access, and retention explicitly permit it.

6 Integrity

Durable transaction evidence

Store reviewer decisions, action keys, destination receipts, and reconciliation status in the operational application rather than relying on model history or a kernel invocation log.

Semantic Kernel production FAQ

Decide where Semantic Kernel still earns a place in governed AI operations

Current answers for teams weighing Semantic Kernel's application-level orchestration against newer Microsoft agent tooling, durable workflow requirements, and production control obligations.

Should a team start a new agent workflow with Semantic Kernel or Microsoft Agent Framework?

Microsoft describes Agent Framework as the direct successor to Semantic Kernel's agent framework and AutoGen, with explicit workflows and state management for new agent applications. MetaCTO therefore evaluates Agent Framework first for a greenfield agent or graph workflow. Semantic Kernel can remain the pragmatic choice when an existing .NET, Python, or Java service already relies on its lightweight kernel, plugins, prompts, and function-calling abstractions and the value of migrating does not outweigh the operating risk. The decision should be made against one representative workflow, including approval, recovery, telemetry, and long-term ownership, not from an SDK feature checklist alone.

Does Semantic Kernel function calling authorize a model to change a business system?

No. Semantic Kernel can describe plugin functions to a model, marshal selected arguments, and automatically invoke functions, but model selection is not business authorization. MetaCTO registers only the functions needed for the current case, separates reads from writes, validates typed arguments, and rechecks the actor, record version, policy, and approval in trusted application code before any external side effect. A write-capable plugin should also use an idempotency key and return a destination receipt so retries can be reconciled instead of blindly repeated.

Which Semantic Kernel filters matter for production controls, and what can they not replace?

Microsoft documents function-invocation, prompt-render, and automatic-function-invocation filters. They can inspect or stop execution, redact or revise a rendered prompt, handle function exceptions, override results, and terminate an automatic function-calling loop. They are useful enforcement and evidence points, but they do not replace destination authorization, durable workflow state, or human approval for consequential actions. MetaCTO keeps each filter focused, tests the complete pipeline, and avoids depending on implicit filter order because Microsoft notes that dependency-injected filter ordering is not guaranteed.

Can Semantic Kernel own a multi-day process, human approval, and failure recovery by itself?

It should not be the only durable owner for a critical operational process. Microsoft's Semantic Kernel Process Framework documentation still labels that framework experimental, while the kernel itself is a lightweight service-and-plugin container whose plugin collection is mutable. MetaCTO stores the case state, deadlines, approval decisions, action keys, and reconciliation status in an application database or proven durable orchestrator. The kernel can be created per use with the approved plugin set, then safely reconstructed after a timeout or deployment without losing the authoritative process record.

How should a team observe Semantic Kernel without leaking operational data?

Semantic Kernel emits OpenTelemetry-compatible logs, metrics, and distributed traces in supported SDKs; Microsoft currently documents this observability for .NET and Python, not Java, and notes that function arguments and results can appear at debug level. MetaCTO correlates model and function spans to a non-sensitive case ID, disables sensitive payload capture by default, and applies explicit access, redaction, sampling, and retention rules before enabling deeper traces. Runtime telemetry is then paired with business signals such as approval rate, exception reason, destination receipt, and final case outcome so a technically successful call is not mistaken for a successful operation.

Complete the application-owned AI system

Connect Semantic Kernel to managed models, durable workflows, and accountable operations

Semantic Kernel supplies an in-code coordination layer. Pair it with governed model infrastructure, reliable business process control, permissioned context, and the systems where approved work becomes operational truth.

See where the operating pattern applies.

Map your first AI opportunity

Tell us where work gets stuck. We’ll map the context, controls, and production workflow before deciding where Semantic Kernel fits.

No spam
100% secure
Quick response

Subscribe to our newsletter

Be the first to get insights on Operational AI, engineering quality, and building systems that move real business metrics.

By subscribing you agree to our Privacy Policy.