AI Agent Governance Toolkit - by Microsoft Runtime governance for AI agents through deterministic policy enforcement, zero-trust identity, execution sandboxing, and SRE for autonomous agents. Covers all 10 OWASP Agentic risks with 13,000+ tests. https://github.com/microsoft/agent-governance-toolkit…

microsoft/agent-governance-toolkit

Source: https://github.com/microsoft/agent-governance-toolkit

🌍 English | 日本語 | 简体中文 | 한국어

Agent Governance Toolkit

📖 Docs · 🚀 Quick Start · 📋 Specifications · 📦 PyPI · 📝 Changelog

Public Preview – production-quality, Microsoft-signed releases. May have breaking changes before GA.

Runtime governance for AI agents. Every tool call, resource access, and inter-agent message is evaluated against policy before execution – deterministic, sub-millisecond, and auditable.

Agent Action ──► Policy Check ──► Allow / Deny ──► Audit Log    (< 0.1 ms)

Prompt-based safety (“please follow the rules”) has a 26.67% policy violation rate in red-team testing. AGT’s application-layer enforcement: 0.00%.

Python · TypeScript · .NET · Rust · Go. Works with LangChain, CrewAI, AutoGen, OpenAI Agents, Google ADK, Semantic Kernel, AWS Bedrock, and 20+ more.

Quick Start

pip install agent-governance-toolkit[full]

from agent_os.policies import (
    PolicyEvaluator, PolicyDocument, PolicyRule,
    PolicyCondition, PolicyAction, PolicyOperator, PolicyDefaults
)

evaluator = PolicyEvaluator(policies=[PolicyDocument(
    name="my-policy", version="1.0",
    defaults=PolicyDefaults(action=PolicyAction.ALLOW),
    rules=[PolicyRule(
        name="block-dangerous-tools",
        condition=PolicyCondition(
            field="tool_name",
            operator=PolicyOperator.IN,
            value=["execute_code", "delete_file"]
        ),
        action=PolicyAction.DENY, priority=100,
    )],
)])

result = evaluator.evaluate({"tool_name": "web_search"})    # ✅ Allowed
result = evaluator.evaluate({"tool_name": "delete_file"})   # ❌ Blocked

import { PolicyEngine } from "@microsoft/agent-governance-sdk";

const engine = new PolicyEngine([
  { action: "web_search", effect: "allow" },
  { action: "shell_exec", effect: "deny" },
]);
engine.evaluate("web_search"); // "allow"
engine.evaluate("shell_exec"); // "deny"

using AgentGovernance;
using AgentGovernance.Extensions.ModelContextProtocol;
using AgentGovernance.Policy;

var kernel = new GovernanceKernel(new GovernanceOptions
{
    PolicyPaths = new() { "policies/default.yaml" },
});
var result = kernel.EvaluateToolCall("did:mesh:agent-1", "web_search",
    new() { ["query"] = "latest AI news" });

// MCP server integration
builder.Services.AddMcpServer()
    .WithGovernance(options => options.PolicyPaths.Add("policies/mcp.yaml"));

use agent_governance::{AgentMeshClient, ClientOptions};

let client = AgentMeshClient::new("my-agent").unwrap();
let result = client.execute_with_governance("data.read", None);
assert!(result.allowed);

import agentmesh "github.com/microsoft/agent-governance-toolkit/agent-governance-golang"

client, _ := agentmesh.NewClient("my-agent",
    agentmesh.WithPolicyRules([]agentmesh.PolicyRule{
        {Action: "data.read", Effect: agentmesh.Allow},
        {Action: "*", Effect: agentmesh.Deny},
    }),
)
result := client.ExecuteWithGovernance("data.read", nil)

CLI tools:

agt doctor                                        # check installation
agt verify                                        # OWASP compliance check
agt verify --evidence ./agt-evidence.json --strict # fail CI on weak evidence
agt red-team scan ./prompts/ --min-grade B         # prompt injection audit
agt lint-policy policies/                          # validate policy files

Full walkthrough: quickstart.md – zero to governed agents in 10 minutes with YAML, OPA/Rego, and Cedar policies. 🌍 Also in: 日本語 | 简体中文 | 한국어

Core Capabilities

Policy Engine

Deterministic allow/deny evaluation for every agent action. Sub-millisecond latency (0.012ms p50 for single rule, 35K ops/sec concurrent). Supports YAML, OPA/Rego, and Cedar policy languages. Fail-closed by default – if the engine errors, the action is denied.

Agent OS · Benchmarks · Spec

Zero-Trust Identity

Ed25519 + quantum-safe ML-DSA-65 agent credentials. Behavioral trust scoring (0–1000) that decays when agents act outside expected patterns. SPIFFE/SVID compatible. Trust ceilings propagate through delegation chains – a delegated agent can never exceed its parent’s trust level.

AgentMesh · Spec

Execution Sandboxing

Four privilege rings (kernel, supervisor, user, untrusted) with hardware-style isolation semantics. Saga orchestration for multi-step workflows with automatic compensation on failure. Kill switch for immediate agent termination.

Runtime · Hypervisor · Spec

Agent SRE

SLOs, error budgets, replay debugging, chaos engineering, and circuit breakers for agent fleets. OTel-native observability with structured governance events.

Agent SRE · Spec

Audit and Compliance

Tamper-evident Merkle-chained audit logs. Reconstructible Decision BOMs from observability signals. Automated compliance mapping for EU AI Act, SOC 2, HIPAA, and GDPR. CloudEvents export for SIEM integration.

Compliance · Spec

MCP Security Gateway

Tool poisoning detection, description drift monitoring, typosquatting checks, and hidden instruction scanning for MCP tool definitions.

MCP Scanner · Spec

Additional Capabilities

Specifications

Every major component has a formal RFC 2119 specification with conformance tests. These specs define the behavioral contract – what implementations MUST, SHOULD, and MAY do.

992 conformance tests ensure code stays aligned to specs. 25 Architecture Decision Records document why.

Framework Support

Full list: Framework Integrations · Quickstart Examples

OWASP Agentic Top 10

AGT covers all 10 risks identified in the OWASP Agentic Security Top 10:

Regulatory alignment: EU AI Act · NIST AI RMF · SOC 2

Install

All five languages implement core governance (policy, identity, trust, audit). Python has the full stack. See Language Package Matrix for per-language coverage.

Security

AGT enforces governance at the Python middleware layer, not at the OS kernel level. The policy engine and agents share the same process boundary.

Production recommendation: Run each agent in a separate container for OS-level isolation. See Architecture – Security Boundaries.

See Known Limitations for honest design boundaries and recommended layered defense.

Documentation

Contributing

Contributing Guide · Community · Security Policy · Changelog

Using AGT? Add your organization to ADOPTERS.md.

Governance

Important Notes

If you use the Agent Governance Toolkit to build applications that operate with third-party agent frameworks or services, you do so at your own risk. We recommend reviewing all data being shared with third-party services and being cognizant of third-party practices for retention and location of data.

License

This project is licensed under the MIT License.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft’s Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party’s policies.