{"slug": "agent-governance-toolkit-microsoft-s-answer-to-which-agent-did-this", "title": "Agent Governance Toolkit: Microsoft's Answer to \"Which Agent Did This?\"", "summary": "Microsoft released Agent Governance Toolkit (AGT), an MIT-licensed, Public Preview toolkit that enforces policy, identity, sandboxing, and SRE for autonomous AI agents, covering all 10 OWASP Agentic Top 10 risks with a deterministic, fail-closed policy kernel that sits outside the prompt. The toolkit, which has over 5,500 GitHub stars and was updated August 1, 2026, intercepts every tool call in application code before the model's intent reaches the wire, making denied actions structurally impossible. Microsoft cites OWASP LLM01:2025 and Andriushchenko et al. (ICLR 2025) reporting a 100% attack success rate on GPT-4o, GPT-3.5, Claude 3, and Llama-3 using adaptive attacks, arguing that prompt-level safety is insufficient.", "body_md": "# Agent Governance Toolkit: Microsoft's Answer to \"Which Agent Did This?\"\n\nAgent Governance Toolkit (AGT) is Microsoft's MIT-licensed policy enforcement, zero-trust identity, execution sandboxing, and SRE toolkit for autonomous AI agents, covering all 10 OWASP Agentic Top 10 risks with a deterministic, fail-closed policy kernel that sits outside the prompt.\n\n- ⭐ 5564\n- Python\n- Rust\n- TypeScript\n- MIT\n- Updated 2026-08-02\n\n[MCP Server Security: 10-Server Production Stack](https://dibi8.com/resources/llm-frameworks/mcp-server-security-audit-2026-real-cases/) •\n[AI Agent Frameworks Compared: LangChain vs CrewAI vs AutoGen vs LlamaIndex vs LangGraph](https://dibi8.com/resources/llm-frameworks/ai-agent-frameworks-comparison-2026/)\n\n## What Is Agent Governance Toolkit? [#](#what-is-agent-governance-toolkit)\n\n**Agent Governance Toolkit (AGT)** is Microsoft’s answer to three questions every team deploying autonomous agents eventually has to answer: *Is this action allowed? Which agent did this? Can you prove what happened?* Per its own README, it’s “Policy enforcement, identity, sandboxing, and SRE for autonomous AI agents. One `pip install`\n\n, any framework.”\n\n🔗 **GitHub**: [https://github.com/microsoft/agent-governance-toolkit](https://github.com/microsoft/agent-governance-toolkit)\n📖 **Docs**: [microsoft.github.io/agent-governance-toolkit](https://microsoft.github.io/agent-governance-toolkit)\n\nMIT licensed, at **5,500+ GitHub stars**, currently labeled **Public Preview** with a commit from **August 1, 2026**, and carrying an “OWASP Agentic Top 10 — 10/10 Covered” badge — a specific, checkable claim rather than vague “enterprise-grade security” marketing.\n\n## The Argument Against Prompt-Level Safety [#](#the-argument-against-prompt-level-safety)\n\nThe README makes its case with citations, not just assertion. It quotes [OWASP LLM01:2025](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) stating “it is unclear if there are fool-proof methods of prevention for prompt injection,” and cites [Andriushchenko et al. (ICLR 2025)](https://arxiv.org/abs/2404.02151) reporting a **100% attack success rate** on GPT-4o, GPT-3.5, Claude 3, and Llama-3 using adaptive attacks against the JailbreakBench benchmark. It also references Microsoft’s own [Lessons from Red Teaming 100 Generative AI Products](https://www.microsoft.com/en-us/security/blog/2025/01/13/3-takeaways-from-red-teaming-100-generative-ai-products/): “mitigations do not eliminate risk entirely.”\n\nAGT’s response isn’t to try to win that fight inside the prompt. Every tool call, message send, and delegation is intercepted in **deterministic application code before the model’s intent reaches the wire**. An action a policy denies isn’t merely unlikely — it’s structurally impossible, because the code path to execute it doesn’t run.\n\n```\nAgent ──► Policy Engine ──► Identity ──► Audit Log\n            (YAML/OPA/Cedar)  (SPIFFE/DID/mTLS)  (Tamper-evident)\n                 │                                      │\n                 ├── Allowed ──► Tool executes           │\n                 └── Denied  ──► GovernanceDenied        │\n                                                        ▼\n                                                 Decision Record\n```\n\nEvery layer is optional — start with `govern()`\n\nfor policy enforcement and audit logging, and add identity/sandboxing/SRE layers as your risk profile grows.\n\n## Quickstart: Governing a Tool in Two Lines [#](#quickstart-governing-a-tool-in-two-lines)\n\n```\npip install \"agent-governance-toolkit[full]\"\npython\nfrom agentmesh.governance import govern\n\nsafe_tool = govern(my_tool, policy=\"policy.yaml\")   # every call checked, logged, enforced\n```\n\nA policy is plain YAML:\n\n```\n# policy.yaml\napiVersion: governance.toolkit/v1\nname: production-policy\ndefault_action: allow\nrules:\n  - name: block-destructive\n    condition: \"action.type in ['drop', 'delete', 'truncate']\"\n    action: deny\n    description: \"Destructive operations require human approval\"\n\n  - name: require-approval-for-send\n    condition: \"action.type == 'send_email'\"\n    action: require_approval\n    approvers: [\"security-team\"]\n>>> safe_tool(action=\"read\", table=\"users\")\n{'table': 'users', 'rows': 42}\n\n>>> safe_tool(action=\"drop\", table=\"users\")\nGovernanceDenied: Action denied by policy rule 'block-destructive':\n  Destructive operations require human approval\n```\n\nFor Claude Code specifically, governance installs as a plugin:\n\n```\n/plugin marketplace add microsoft/agent-governance-toolkit\n/plugin install agt-governance@agent-governance-toolkit\n```\n\n## Every Major Language Gets a Real SDK, Not Just Python [#](#every-major-language-gets-a-real-sdk-not-just-python)\n\n| Language | Package | Install |\n|---|---|---|\n| Python | `agent-governance-toolkit` | `pip install \"agent-governance-toolkit[full]\"` |\n| TypeScript | `@microsoft/agent-governance-sdk` | `npm install @microsoft/agent-governance-sdk` |\n| .NET | `Microsoft.AgentGovernance` | `dotnet add package Microsoft.AgentGovernance` |\n| Rust | `agent-governance` | `cargo add agent-governance` |\n| Go | `agent-governance-toolkit` | `go get github.com/microsoft/agent-governance-toolkit/agent-governance-golang` |\n\nAll five SDKs implement core governance (policy, identity, trust, audit); the Python distribution carries the full stack (sandboxing, SRE, compliance tooling). A quick taste of the Rust and TypeScript APIs:\n\n``` js\nuse agent_governance::{AgentMeshClient, ClientOptions};\n\nlet client = AgentMeshClient::new(\"my-agent\").unwrap();\nlet result = client.execute_with_governance(\"data.read\", None);\njs\nimport { PolicyEngine } from \"@microsoft/agent-governance-sdk\";\n\nconst engine = new PolicyEngine([\n  { action: \"web_search\", effect: \"allow\" },\n  { action: \"shell_exec\", effect: \"deny\" },\n]);\nengine.evaluate(\"web_search\"); // \"allow\"\nengine.evaluate(\"shell_exec\"); // \"deny\"\n```\n\n## The Nine Packages, at a Glance [#](#the-nine-packages-at-a-glance)\n\n| Package | What it does |\n|---|---|\nAgent OS | Policy engine, agent lifecycle, governance gate |\nAgent Control Specification | Stateless, deterministic, fail-closed policy decision runtime (Rust core) |\nAgent Mesh | Agent discovery, routing, and trust mesh |\nAgent Runtime | Execution sandboxing with four privilege rings |\nAgent SRE | Kill switch, SLO monitoring, chaos testing |\nAgent Compliance | OWASP verification, policy linting, integrity checks |\nAgent Marketplace | Plugin governance and trust scoring |\nAgent Lightning | RL training governance with violation penalties |\nAgent Hypervisor | Execution audit, delta engine, command denylist enforcement |\n\nBeyond the core packages, AGT also ships an **MCP Security Gateway** (tool poisoning detection, drift monitoring, typosquatting, hidden-instruction scanning), **Shadow AI Discovery** (finding unregistered agents across processes/configs/repos), a real-time **Governance Dashboard**, and a **12-vector PromptDefense Evaluator** for prompt-injection auditing.\n\n## Framework Support [#](#framework-support)\n\nDocumented integration, native or adapter-level, spans most of the current agent-framework landscape: **Microsoft Agent Framework** (native middleware), **Semantic Kernel** (native), **AutoGen**, **LangGraph/LangChain**, **CrewAI**, **OpenAI Agents SDK**, **Claude Code** (governance plugin), **Google ADK**, **LlamaIndex**, **Haystack**, **Mastra**, **Dify**, **Azure AI Foundry**, and **GitHub Copilot CLI**.\n\n## Being Honest About What This Doesn’t Cover [#](#being-honest-about-what-this-doesnt-cover)\n\nThe Security section of the README is unusually direct for a vendor toolkit: **AGT enforces governance at the application middleware layer, not at the OS kernel level — the policy engine and the agent share the same process boundary.** The stated production recommendation is to still run each agent in a separate container for OS-level isolation on top of AGT’s policy layer.\n\nSupply-chain and code-quality signals backing the project:\n\n| Tool | Coverage |\n|---|---|\n| CodeQL | Python + TypeScript SAST |\n| Gitleaks | Secret scanning on PR/push/weekly |\n| ClusterFuzzLite | 7 fuzz targets (policy, injection, MCP, sandbox, trust) |\n| Dependabot | 13 ecosystems |\n| OpenSSF Scorecard | Weekly scoring + SARIF upload |\n\nA dedicated [Known Limitations](https://github.com/microsoft/agent-governance-toolkit/blob/main/docs/LIMITATIONS.md) doc lays out honest design boundaries and recommended layered defense — worth reading before treating AGT as a complete security solution rather than one layer of one.\n\n## Use Cases [#](#use-cases)\n\n### 1. Multi-Agent Systems Sharing One API Key [#](#1-multi-agent-systems-sharing-one-api-key)\n\nThe README’s own framing: “five agents might share a single API key… when something goes wrong, ‘an agent did it’ is not an incident response.” AGT’s identity layer (SPIFFE/DID/mTLS) is specifically aimed at making “which agent did this” answerable.\n\n### 2. Gating Destructive Tool Calls Behind Human Approval [#](#2-gating-destructive-tool-calls-behind-human-approval)\n\nThe `require_approval`\n\npolicy action (routing an action to named approvers before it executes) fits the common real-world case: an agent should be able to *propose* a destructive or sensitive action without being able to unilaterally *execute* it.\n\n### 3. Auditing MCP Servers for Tool Poisoning [#](#3-auditing-mcp-servers-for-tool-poisoning)\n\nThe MCP Security Gateway’s drift monitoring and hidden-instruction scanning target a specific, documented MCP-ecosystem risk class — tools that look benign at review time but change behavior, or hide instructions, later.\n\n### 4. Compliance Evidence for Regulated Deployments [#](#4-compliance-evidence-for-regulated-deployments)\n\nTamper-evident decision records (what policy was active, what was requested, why it was allowed/denied) are built for exactly the audit conversation the README opens with — “auditors and regulators need tamper-evident records.”\n\n## Related Repositories [#](#related-repositories)\n\n| Repository | Purpose |\n|---|---|\n|\n\n[Semantic Kernel](https://github.com/microsoft/semantic-kernel)## Related Articles [#](#related-articles)\n\n[MCP Server Security: 10-Server Production Stack](https://dibi8.com/resources/llm-frameworks/mcp-server-security-audit-2026-real-cases/)— pairs directly with AGT’s MCP Security Gateway component[AI Agent Frameworks Compared: LangChain vs CrewAI vs AutoGen vs LlamaIndex vs LangGraph](https://dibi8.com/resources/llm-frameworks/ai-agent-frameworks-comparison-2026/)— AGT integrates with all five as adapters or native middleware\n\n## Conclusion [#](#conclusion)\n\n**Agent Governance Toolkit** treats agent safety as an application-architecture problem, not a prompting problem — every tool call gets intercepted and checked against a deterministic policy before it ever reaches an external system, regardless of what the model “intended.” Backed by real academic citations for why prompt-level safety alone is insufficient, a genuinely broad framework-integration list, and an unusually candid Limitations doc about what the middleware layer doesn’t cover (OS-level isolation still needs containers), it’s a serious entry in the AI-agent-security space rather than a compliance-badge wrapper — just still a Public Preview, not a GA release.\n\n**Best for**: Teams shipping autonomous agents to production who need answers to “was this allowed,” “which agent did it,” and “can you prove it” — especially across a mixed stack of frameworks and languages.\n\n**GitHub**: [https://github.com/microsoft/agent-governance-toolkit](https://github.com/microsoft/agent-governance-toolkit)\n\n*Last updated: 2026-08-02*", "url": "https://wpnews.pro/news/agent-governance-toolkit-microsoft-s-answer-to-which-agent-did-this", "canonical_source": "https://dibi8.com/resources/llm-frameworks/agent-governance-toolkit-microsoft-2026/", "published_at": "2026-08-02 14:50:00+00:00", "updated_at": "2026-08-02 16:04:08.393110+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-policy", "ai-tools", "ai-infrastructure"], "entities": ["Microsoft", "Agent Governance Toolkit", "OWASP", "GPT-4o", "GPT-3.5", "Claude 3", "Llama-3", "Andriushchenko et al."], "alternates": {"html": "https://wpnews.pro/news/agent-governance-toolkit-microsoft-s-answer-to-which-agent-did-this", "markdown": "https://wpnews.pro/news/agent-governance-toolkit-microsoft-s-answer-to-which-agent-did-this.md", "text": "https://wpnews.pro/news/agent-governance-toolkit-microsoft-s-answer-to-which-agent-did-this.txt", "jsonld": "https://wpnews.pro/news/agent-governance-toolkit-microsoft-s-answer-to-which-agent-did-this.jsonld"}}