[AG-UI] [.NET] Workflow AsAgent and Unintended state sharing

[ecc-parity-check]

Hi,

As currently the way to use AG-UI on the server side is to initialize it on app startup with

var workflowAsAgent = workflow.AsAgent();
app.MapAGUI("/sse", workflowAsAgent);

this means we need to have a single instance of a Workflow as Agent for the entire lifetime of the app's instance.
But in the documentation we have a warning about doing so:

It is not recommended to reuse a single workflow instance for multiple tasks or requests, as this can lead to unintended state sharing. Instead, it is recommended to create a new workflow instance from the builder for each task or request to ensure proper state isolation and thread safety.

https://learn.microsoft.com/en-us/agent-framework/user-guide/workflows/state-isolation?pivots=programming-language-csharp

So could you clarify, is it safe to use Workflows with AG-UI or it's better to avoid it?

[moonbox3]

Adding @javiercn

[moonbox3]

I can also help answer, but it's more grounded in the Python implementation we have (@javiercn can correct me on anything that may be different in .NET):

This is safe by design. The AG-UI protocol is stateless per-request: the client sends the full message history and state with every POST. On the server side, each request gets its own execution context (fresh thread, fresh flow state, fresh run). The registered workflow/agent instance is only used as a stateless handler that holds configuration (instructions, tools, model settings), not per-request mutable state.

In our Python implementation, you can see this clearly in run_agent_stream(): each request creates a new FlowState(), a new AgentThread(), and parses messages/state from the incoming request. Nothing is shared between concurrent requests.

The documentation warning about state isolation applies to imperative workflow usage where you call workflow.run() directly and the workflow accumulates internal step state across invocations. With AG-UI, the protocol itself prevents this -- the client is the source of truth for conversation history and shared state.