Microsoft Agent Governance Toolkit
Deterministic policy, identity, audit, and runtime controls for autonomous agent actions.
Per-dimension scores and reasoning
Evidence shows: least privilege via YAML policies allowing/denying actions, user confirmation via require_approval, data flow transparency via audit logs and decision records, sensitive data handling via input validation (rejecting NaN/Inf) and audit logs, dependency security via Dependabot, SLSA, OpenSSF Scorecard, external effects controlled via policies and sandboxing, rollback via audit logs and policy change management, source attribution via verified Microsoft organization. Deductions: static review cannot verify actual execution, and some security measures are only asserted without detailed evidence.
Evidence shows: self-consistency via formal specs and 992 conformance tests, dependency availability via multi-language SDKs and package management, failure messages via CLI error handling and tests ensuring no internal detail leakage. Deductions: static review cannot verify runtime reliability, and dependency availability lacks actual runtime evidence.
Evidence shows: broad audience and scenarios with multiple frameworks and languages, capability boundaries via policies and privilege rings, trigger precision via policy conditions and intervention points, environment fit via multi-platform deployment docs and Docker support. Deductions: static review cannot verify actual adaptation, and some integrations are only asserted without detailed evidence.
Evidence shows: clear information architecture with docs, specs, ADRs, detailed install notes for multiple languages, naming stability via versioning and deprecation warnings, rich examples and FAQ, known limitations documented, MIT license, changelog present, maintenance responsibility via GOVERNANCE.md and MAINTAINERS.md. Deductions: static review cannot verify documentation-code consistency, and some docs may be outdated.
Evidence shows: output usability via CLI and SDK multiple output formats (JSON, plain), marginal value via solving real problems (policy enforcement, audit), cost-benefit via open-source free and multiple deployment options. Deductions: static review cannot quantify actual benefits, and cost-benefit lacks specific data.
Evidence shows: claim traceability via specs, tests, and compliance mappings, cross-source corroboration via multiple standards (OWASP, NIST) and external certifications (AARM, ATF), fact-inference separation via docs distinguishing design intent and implementation. Deductions: static review cannot verify external certifications' authenticity, and some claims rely solely on project's own docs.
- Static review cannot verify actual execution; all security claims need validation through running tests and real deployment.
- Some security measures (e.g., SLSA, OpenSSF Scorecard) are only asserted without detailed evidence; further verification needed.
- Authenticity of external certifications (AARM, ATF) needs independent verification.
- Documentation may be outdated; cross-check with actual code.
What does this agent do, and when should you use it?
Agent Governance Toolkit (AGT) is Microsoft’s open-source toolkit for governing autonomous agents that call tools, browse the web, query databases, or delegate work. It evaluates policy in application middleware before tool calls, message sends, and delegations reach external systems, rather than relying on prompt instructions. The repository includes Agent OS, Agent Control Specification, Agent Mesh, Agent Runtime, Agent SRE, and Agent Compliance, with installation paths for Python, TypeScript, .NET, Rust, and Go. Policies can use YAML, OPA, or Cedar and can be combined with identity, trust, and tamper-evident audit records; denied governed calls raise `GovernanceDenied`. It suits teams that want to introduce enforcement and audit incrementally, while recognizing that its policy boundary is in-process and production deployments should isolate agents in separate containers.
A developer imports govern with from agentmesh.governance import govern and wraps an existing tool as govern(my_tool, policy="policy.yaml"). For each call, AGT evaluates YAML policy conditions such as action.type in ['drop', 'delete', 'truncate'], records the decision, and raises GovernanceDenied when a rule blocks the action; only an allowed call reaches the wrapped tool. For programmatic evaluation, AgentControl.from_path("manifest.yaml") creates a runtime and runtime.evaluate("input", {...}) returns a verdict. Its CLI exposes agt doctor, agt verify, agt red-team scan, and agt lint-policy for installation checks, OWASP evidence verification, prompt-injection audits, and policy validation. The repository also documents optional MCP Security Gateway, execution sandboxing, SLO and chaos-testing, trust-scoring, and framework-adapter capabilities.
- A team operating an agent with production database tools that must block
drop,delete, ortruncatewhile retaining policy-controlled reads. - A developer building a customer-support or operations agent with the OpenAI Agents SDK who needs policy-gated tool calls and trust tiers.
- A platform team running several agents with shared credentials that needs AgentMesh identity, delegation chains, and audit records to attribute actions.
- A team publishing MCP tools that wants checks for tool poisoning, drift, typosquatting, and hidden instructions.
- A security or compliance team with OWASP Agentic AI Top 10, NIST AI RMF, EU AI Act, or SOC 2 evidence needs that can use
agt verifyand audit exports in its review process.
What are this agent's strengths and limitations?
- It places policy decisions at application-code interception points for tool calls, message sends, and delegations, enabling deterministic blocking of denied actions.
- Teams can begin with a two-line
govern()wrapper and add identity, audit, sandboxing, and SRE layers as needed. - It documents Python, TypeScript, .NET, Rust, and Go paths plus integrations or adapters for the OpenAI Agents SDK, Claude Code, Semantic Kernel, LangGraph, CrewAI, and MCP.
- It includes
agt verify, policy linting, prompt-injection scanning, formal specifications, and 992 conformance tests as governance-oriented project assets.
- The project is labeled Public Preview and may introduce breaking changes before GA; prior Python package names now remain as stub packages redirecting to consolidated distributions.
- Governance is enforced in application middleware, with the policy engine and agent sharing a process boundary; the documentation recommends separate containers per agent for OS-level isolation.
- The quick start requires
agent-governance-toolkit[full]or the core distribution, because the base wheel contains only the compliance CLI, which can require changes to existing installs. - Language coverage is not identical: the README states that Python has the full stack, while the other SDKs implement core governance capabilities.
How do you install or deploy this agent?
Python 3.10+ is required. Install the full quick-start distribution:
pip install agent-governance-toolkit[full]The base agent-governance-toolkit wheel installs only the compliance CLI; governance modules are in the consolidated core distribution. Other documented installation paths are npm install @microsoft/agent-governance-sdk for TypeScript, dotnet add package Microsoft.AgentGovernance for .NET, cargo add agent-governance for Rust, and go get github.com/microsoft/agent-governance-toolkit/agent-governance-golang for Go. Azure-integrated features can optionally use AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET.
How do you use this agent?
Create policy.yaml with, for example, default_action: allow and a rule whose condition is action.type in ['drop', 'delete', 'truncate'] and whose action is deny. Then wrap a tool:
from agentmesh.governance import govern
safe_tool = govern(my_tool, policy="policy.yaml")Calling safe_tool(action="read", table="users") evaluates policy before execution; calling safe_tool(action="drop", table="users") is denied with GovernanceDenied. Run agt doctor to check the installation, agt lint-policy policies/ to validate policies, and agt verify --evidence ./agt-evidence.json --strict for strict CI evidence checks.
FAQ
What happens when a policy denies a tool call?
govern() raises GovernanceDenied when policy blocks the action, and the wrapped tool does not execute on that path.Does it replace containers or OS-level isolation?
Is it limited to one agent framework?
Are Azure credentials required to get started?
AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET are listed as optional variables for Azure-integrated features.