Agent Governance Toolkit (AGT) is Microsoft's MIT-licensed policy enforcement, zero-trust identity, execution sandboxing, and SRE toolkit for autonomous AI agents, covering all 10 OWASP Agentic Top 10 risks with a deterministic, fail-closed policy kernel that sits outside the prompt.
- ⭐ 5564
- Python
- Rust
- TypeScript
- MIT
- Updated 2026-08-02
MCP Server Security: 10-Server Production Stack • AI Agent Frameworks Compared: LangChain vs CrewAI vs AutoGen vs LlamaIndex vs LangGraph
What Is Agent Governance Toolkit? # #
Agent Governance Toolkit (AGT) is Microsoft’s answer to three questions every team deploying autonomous agents eventually has to answer: Is this action allowed? Which agent did this? Can you prove what happened? Per its own README, it’s “Policy enforcement, identity, sandboxing, and SRE for autonomous AI agents. One pip install
, any framework.”
🔗 GitHub: https://github.com/microsoft/agent-governance-toolkit 📖 Docs: microsoft.github.io/agent-governance-toolkit
MIT licensed, at 5,500+ GitHub stars, currently labeled Public Preview with a commit from August 1, 2026, and carrying an “OWASP Agentic Top 10 — 10/10 Covered” badge — a specific, checkable claim rather than vague “enterprise-grade security” marketing.
The Argument Against Prompt-Level Safety # #
The README makes its case with citations, not just assertion. It quotes OWASP LLM01:2025 stating “it is unclear if there are fool-proof methods of prevention for prompt injection,” and cites Andriushchenko et al. (ICLR 2025) reporting a 100% attack success rate on GPT-4o, GPT-3.5, Claude 3, and Llama-3 using adaptive attacks against the JailbreakBench benchmark. It also references Microsoft’s own Lessons from Red Teaming 100 Generative AI Products: “mitigations do not eliminate risk entirely.”
AGT’s response isn’t to try to win that fight inside the prompt. Every tool call, message send, and delegation is intercepted in deterministic application code before the model’s intent reaches the wire. An action a policy denies isn’t merely unlikely — it’s structurally impossible, because the code path to execute it doesn’t run.
Agent ──► Policy Engine ──► Identity ──► Audit Log
(YAML/OPA/Cedar) (SPIFFE/DID/mTLS) (Tamper-evident)
│ │
├── Allowed ──► Tool executes │
└── Denied ──► GovernanceDenied │
▼
Decision Record
Every layer is optional — start with govern()
for policy enforcement and audit logging, and add identity/sandboxing/SRE layers as your risk profile grows.
Quickstart: Governing a Tool in Two Lines # #
pip install "agent-governance-toolkit[full]"
python
from agentmesh.governance import govern
safe_tool = govern(my_tool, policy="policy.yaml") # every call checked, logged, enforced
A policy is plain YAML:
apiVersion: governance.toolkit/v1
name: production-policy
default_action: allow
rules:
- name: block-destructive
condition: "action.type in ['drop', 'delete', 'truncate']"
action: deny
description: "Destructive operations require human approval"
- name: require-approval-for-send
condition: "action.type == 'send_email'"
action: require_approval
approvers: ["security-team"]
>>> safe_tool(action="read", table="users")
{'table': 'users', 'rows': 42}
>>> safe_tool(action="drop", table="users")
GovernanceDenied: Action denied by policy rule 'block-destructive':
Destructive operations require human approval
For Claude Code specifically, governance installs as a plugin:
/plugin marketplace add microsoft/agent-governance-toolkit
/plugin install agt-governance@agent-governance-toolkit
Every Major Language Gets a Real SDK, Not Just Python # #
| Language | Package | Install |
|---|---|---|
| Python | agent-governance-toolkit |
pip install "agent-governance-toolkit[full]" |
| TypeScript | @microsoft/agent-governance-sdk |
npm install @microsoft/agent-governance-sdk |
| .NET | Microsoft.AgentGovernance |
dotnet add package Microsoft.AgentGovernance |
| Rust | agent-governance |
cargo add agent-governance |
| Go | agent-governance-toolkit |
go get github.com/microsoft/agent-governance-toolkit/agent-governance-golang |
All five SDKs implement core governance (policy, identity, trust, audit); the Python distribution carries the full stack (sandboxing, SRE, compliance tooling). A quick taste of the Rust and TypeScript APIs:
use agent_governance::{AgentMeshClient, ClientOptions};
let client = AgentMeshClient::new("my-agent").unwrap();
let result = client.execute_with_governance("data.read", None);
js
import { PolicyEngine } from "@microsoft/agent-governance-sdk";
const engine = new PolicyEngine([
{ action: "web_search", effect: "allow" },
{ action: "shell_exec", effect: "deny" },
]);
engine.evaluate("web_search"); // "allow"
engine.evaluate("shell_exec"); // "deny"
The Nine Packages, at a Glance # #
| Package | What it does |
|---|---|
| Agent OS | Policy engine, agent lifecycle, governance gate |
| Agent Control Specification | Stateless, deterministic, fail-closed policy decision runtime (Rust core) |
| Agent Mesh | Agent discovery, routing, and trust mesh |
| Agent Runtime | Execution sandboxing with four privilege rings |
| Agent SRE | Kill switch, SLO monitoring, chaos testing |
| Agent Compliance | OWASP verification, policy linting, integrity checks |
| Agent Marketplace | Plugin governance and trust scoring |
| Agent Lightning | RL training governance with violation penalties |
| Agent Hypervisor | Execution audit, delta engine, command denylist enforcement |
Beyond the core packages, AGT also ships an MCP Security Gateway (tool poisoning detection, drift monitoring, typosquatting, hidden-instruction scanning), Shadow AI Discovery (finding unregistered agents across processes/configs/repos), a real-time Governance Dashboard, and a 12-vector PromptDefense Evaluator for prompt-injection auditing.
Framework Support # #
Documented integration, native or adapter-level, spans most of the current agent-framework landscape: Microsoft Agent Framework (native middleware), Semantic Kernel (native), AutoGen, LangGraph/LangChain, CrewAI, OpenAI Agents SDK, Claude Code (governance plugin), Google ADK, LlamaIndex, Haystack, Mastra, Dify, Azure AI Foundry, and GitHub Copilot CLI.
Being Honest About What This Doesn’t Cover # #
The Security section of the README is unusually direct for a vendor toolkit: AGT enforces governance at the application middleware layer, not at the OS kernel level — the policy engine and the agent share the same process boundary. The stated production recommendation is to still run each agent in a separate container for OS-level isolation on top of AGT’s policy layer.
Supply-chain and code-quality signals backing the project:
| Tool | Coverage |
|---|---|
| CodeQL | Python + TypeScript SAST |
| Gitleaks | Secret scanning on PR/push/weekly |
| ClusterFuzzLite | 7 fuzz targets (policy, injection, MCP, sandbox, trust) |
| Dependabot | 13 ecosystems |
| OpenSSF Scorecard | Weekly scoring + SARIF upload |
A dedicated Known Limitations doc lays out honest design boundaries and recommended layered defense — worth reading before treating AGT as a complete security solution rather than one layer of one.
Use Cases # #
1. Multi-Agent Systems Sharing One API Key #
The README’s own framing: “five agents might share a single API key… when something goes wrong, ‘an agent did it’ is not an incident response.” AGT’s identity layer (SPIFFE/DID/mTLS) is specifically aimed at making “which agent did this” answerable.
2. Gating Destructive Tool Calls Behind Human Approval #
The require_approval
policy action (routing an action to named approvers before it executes) fits the common real-world case: an agent should be able to propose a destructive or sensitive action without being able to unilaterally execute it.
3. Auditing MCP Servers for Tool Poisoning #
The MCP Security Gateway’s drift monitoring and hidden-instruction scanning target a specific, documented MCP-ecosystem risk class — tools that look benign at review time but change behavior, or hide instructions, later.
4. Compliance Evidence for Regulated Deployments #
Tamper-evident decision records (what policy was active, what was requested, why it was allowed/denied) are built for exactly the audit conversation the README opens with — “auditors and regulators need tamper-evident records.”
Related Repositories # #
| Repository | Purpose |
|---|---|
Semantic Kernel## Related Articles #
MCP Server Security: 10-Server Production Stack— pairs directly with AGT’s MCP Security Gateway componentAI Agent Frameworks Compared: LangChain vs CrewAI vs AutoGen vs LlamaIndex vs LangGraph— AGT integrates with all five as adapters or native middleware
Conclusion # #
Agent Governance Toolkit treats agent safety as an application-architecture problem, not a prompting problem — every tool call gets intercepted and checked against a deterministic policy before it ever reaches an external system, regardless of what the model “intended.” Backed by real academic citations for why prompt-level safety alone is insufficient, a genuinely broad framework-integration list, and an unusually candid Limitations doc about what the middleware layer doesn’t cover (OS-level isolation still needs containers), it’s a serious entry in the AI-agent-security space rather than a compliance-badge wrapper — just still a Public Preview, not a GA release.
Best for: Teams shipping autonomous agents to production who need answers to “was this allowed,” “which agent did it,” and “can you prove it” — especially across a mixed stack of frameworks and languages.
GitHub: https://github.com/microsoft/agent-governance-toolkit
Last updated: 2026-08-02