Understand conversation-based multi-agent orchestration and its risks.
AutoGen/AG2 makes agent collaboration look like structured conversation.
Learners identify AutoGen/AG2 as a conversational topology.
Why this matters: This prevents teaching it as a generic framework with no distinctive control model.
Problem anchor: a data analyst agent writes a query, a code executor runs it, and a human user proxy approves the final chart before it is shared. The interesting part is not just tool calling; it is who speaks next and when the conversation ends.
AutoGen and AG2 belong to the conversational-agent family. Agents exchange messages, request tools, ask humans, and stop when a termination rule or workflow condition fires.
The analyst proposes SQL, the executor runs it in a sandbox, and the user proxy approves the externally shared summary. Each participant has a bounded role.
The conversation ends when the analyst sends a final answer that passes an evidence check and the user proxy approves sharing.
The team contract lives in agent roles and termination logic.
Learners design bounded conversational participants.
Why this matters: Loose roles and missing termination create runaway chats and duplicated work.
AG2-style ConversableAgent patterns are powerful because any participant can reply, call tools, or hand work to another participant. That also means the system needs clear termination: max turns, keywords, evaluator pass, approval, or explicit state.
Tools should be assigned by responsibility. A reviewer does not need code execution; a user proxy does not need broad database credentials.
| Option | Participant | Owns | Risk | When to choose | Cost | Complexity |
|---|---|---|---|---|---|---|
| Planner/assistant | Breaks task down and proposes next work. | Reasoning and coordination. | Can overdelegate or loop. | Use when task needs decomposition. | Medium | Medium |
| Executor | Runs code or tools in sandbox. | External action under policy. | Unsafe code if sandbox is weak. | Use for tool-heavy tasks. | Medium | High |
| User proxy | Represents human approval or input. | Review and termination authority. | Rubber-stamp if packet is vague. | Use for HITL decisions. | Medium | Medium |
AutoGen, AgentChat, Core, AG2, and Microsoft Agent Framework are not interchangeable.
Learners avoid mixing old tutorials with current AG2/AutoGen APIs.
Why this matters: Version confusion is a known gotcha in AutoGen-style teaching.
Microsoft AutoGen has multiple eras, and AG2 continues the classic AutoGen lineage. Microsoft also points new production agent work toward Microsoft Agent Framework. A lesson should say which family it is teaching.
Do not mix AutoGen 0.2 snippets, current stable AutoGen AgentChat, AG2 docs, and Agent Framework workflows without explanation. Learners will install the wrong package or follow the wrong API shape.
A lesson that says “AG2-style ConversableAgent” should link to AG2 docs and explain the relation to older AutoGen. A Microsoft production lesson should instead point to Microsoft Agent Framework.
This avoids sending greenfield learners toward a maintenance-mode path when the subject is not legacy AutoGen literacy.
A multi-agent chat still needs runtime policy.
Learners implement a tiny message/team simulator.
Why this matters: Conversation does not remove the need for tool security.
If a planner can both invent code and run it with full filesystem access, the “team” has no safety separation. Put execution behind a participant with sandbox limits, allowed tools, and structured results.
Spaced recall: from agent safety, tool output is untrusted. The planner may read executor output, but policy still controls follow-up side effects.
participants = ["planner", "executor", "reviewer"] messages = [] def planner(goal): return {"speaker": "planner", "text": "Ask executor to run the report query."} def executor(message): return {"speaker": "executor", "text": "Query complete: activation=42%. Evidence: report-17."} def reviewer(message): if "Evidence:" in message["text"]: return {"speaker": "reviewer", "text": "FINAL approved with evidence report-17"} return {"speaker": "reviewer", "text": "Need evidence before FINAL"} messages.append(planner("weekly activation")) messages.append(executor(messages[-1])) messages.append(reviewer(messages[-1])) print(messages[-1]["text"])
The reviewer sends FINAL because the executor message includes evidence.
Conversation orchestration needs trace-level evaluation.
Learners create production checks for AutoGen/AG2-style systems.
Why this matters: Final answers alone miss looping, unsafe tools, and weak human review.
A healthy AutoGen/AG2 trace shows each participant doing its job, tools running under the right participant, evidence flowing into the final answer, and termination happening for the intended reason.
Failure modes include runaway chats, repeated planning, executor overreach, unsupported final claims, weak user-proxy approval, and version drift after package updates.
Read the final answer with the conversation trace open.
Retrieval prompt: reconstruct AutoGen/AG2 by naming conversable agents, user proxy, tools, group chat/team pattern, termination, version caveats, and sandboxing.
Design a three-participant AG2-style review: planner, executor, and user proxy. Define tools, who may execute code, termination condition, human approval point, and trace checks. Next rung: compare it against LangGraph and CrewAI for the same task.
In AutoGen/AG2's conversation-based orchestration model, what is the PRIMARY role of the UserProxyAgent?
The UserProxyAgent represents the human side of the conversation: it initiates turns, can run code, and decides when to stop — the AssistantAgent handles LLM reasoning.
You are setting up a two-agent chat and want it to stop automatically without human intervention. Which combination correctly enforces termination?
AutoGen/AG2 terminates a chat when max_turns is reached OR when the configured termination marker (default 'TERMINATE') appears in a message — both guards are needed for reliable auto-stop.
A colleague points you to the 'AutoGen' GitHub org maintained by Microsoft for a new greenfield project. What is the key caveat you should raise?
After the fork, Microsoft's AutoGen and the community's AG2 (ag2ai) diverged in API and roadmap — using docs from the wrong family leads to import errors and missing features.
Why should code execution be routed through a sandboxed participant (e.g., a Docker-based executor) rather than run directly in the orchestrating process? Name at least TWO distinct reasons.
Sandboxing protects the host from unsafe generated code AND produces a structured execution record that becomes part of the auditable conversation trace.
When evaluating a completed multi-agent run, which of the following is the MOST complete evaluation strategy?
Evaluating only the final answer misses hidden failures; a full trace review covers tool correctness, cost, turn efficiency, sandbox use, and human-in-the-loop compliance.