# Agent Governance Toolkit: Microsoft's Answer to "Which Agent Did This?"

> Source: <https://dibi8.com/resources/llm-frameworks/agent-governance-toolkit-microsoft-2026/>
> Published: 2026-08-02 14:50:00+00:00

# Agent Governance Toolkit: Microsoft's Answer to "Which Agent Did This?"

Agent Governance Toolkit (AGT) is Microsoft's MIT-licensed policy enforcement, zero-trust identity, execution sandboxing, and SRE toolkit for autonomous AI agents, covering all 10 OWASP Agentic Top 10 risks with a deterministic, fail-closed policy kernel that sits outside the prompt.

- ⭐ 5564
- Python
- Rust
- TypeScript
- MIT
- Updated 2026-08-02

[MCP Server Security: 10-Server Production Stack](https://dibi8.com/resources/llm-frameworks/mcp-server-security-audit-2026-real-cases/) •
[AI Agent Frameworks Compared: LangChain vs CrewAI vs AutoGen vs LlamaIndex vs LangGraph](https://dibi8.com/resources/llm-frameworks/ai-agent-frameworks-comparison-2026/)

## What Is Agent Governance Toolkit? [#](#what-is-agent-governance-toolkit)

**Agent Governance Toolkit (AGT)** is Microsoft’s answer to three questions every team deploying autonomous agents eventually has to answer: *Is this action allowed? Which agent did this? Can you prove what happened?* Per its own README, it’s “Policy enforcement, identity, sandboxing, and SRE for autonomous AI agents. One `pip install`

, any framework.”

🔗 **GitHub**: [https://github.com/microsoft/agent-governance-toolkit](https://github.com/microsoft/agent-governance-toolkit)
📖 **Docs**: [microsoft.github.io/agent-governance-toolkit](https://microsoft.github.io/agent-governance-toolkit)

MIT licensed, at **5,500+ GitHub stars**, currently labeled **Public Preview** with a commit from **August 1, 2026**, and carrying an “OWASP Agentic Top 10 — 10/10 Covered” badge — a specific, checkable claim rather than vague “enterprise-grade security” marketing.

## The Argument Against Prompt-Level Safety [#](#the-argument-against-prompt-level-safety)

The README makes its case with citations, not just assertion. It quotes [OWASP LLM01:2025](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) stating “it is unclear if there are fool-proof methods of prevention for prompt injection,” and cites [Andriushchenko et al. (ICLR 2025)](https://arxiv.org/abs/2404.02151) reporting a **100% attack success rate** on GPT-4o, GPT-3.5, Claude 3, and Llama-3 using adaptive attacks against the JailbreakBench benchmark. It also references Microsoft’s own [Lessons from Red Teaming 100 Generative AI Products](https://www.microsoft.com/en-us/security/blog/2025/01/13/3-takeaways-from-red-teaming-100-generative-ai-products/): “mitigations do not eliminate risk entirely.”

AGT’s response isn’t to try to win that fight inside the prompt. Every tool call, message send, and delegation is intercepted in **deterministic application code before the model’s intent reaches the wire**. An action a policy denies isn’t merely unlikely — it’s structurally impossible, because the code path to execute it doesn’t run.

```
Agent ──► Policy Engine ──► Identity ──► Audit Log
            (YAML/OPA/Cedar)  (SPIFFE/DID/mTLS)  (Tamper-evident)
                 │                                      │
                 ├── Allowed ──► Tool executes           │
                 └── Denied  ──► GovernanceDenied        │
                                                        ▼
                                                 Decision Record
```

Every layer is optional — start with `govern()`

for policy enforcement and audit logging, and add identity/sandboxing/SRE layers as your risk profile grows.

## Quickstart: Governing a Tool in Two Lines [#](#quickstart-governing-a-tool-in-two-lines)

```
pip install "agent-governance-toolkit[full]"
python
from agentmesh.governance import govern

safe_tool = govern(my_tool, policy="policy.yaml")   # every call checked, logged, enforced
```

A policy is plain YAML:

```
# policy.yaml
apiVersion: governance.toolkit/v1
name: production-policy
default_action: allow
rules:
  - name: block-destructive
    condition: "action.type in ['drop', 'delete', 'truncate']"
    action: deny
    description: "Destructive operations require human approval"

  - name: require-approval-for-send
    condition: "action.type == 'send_email'"
    action: require_approval
    approvers: ["security-team"]
>>> safe_tool(action="read", table="users")
{'table': 'users', 'rows': 42}

>>> safe_tool(action="drop", table="users")
GovernanceDenied: Action denied by policy rule 'block-destructive':
  Destructive operations require human approval
```

For Claude Code specifically, governance installs as a plugin:

```
/plugin marketplace add microsoft/agent-governance-toolkit
/plugin install agt-governance@agent-governance-toolkit
```

## Every Major Language Gets a Real SDK, Not Just Python [#](#every-major-language-gets-a-real-sdk-not-just-python)

| Language | Package | Install |
|---|---|---|
| Python | `agent-governance-toolkit` | `pip install "agent-governance-toolkit[full]"` |
| TypeScript | `@microsoft/agent-governance-sdk` | `npm install @microsoft/agent-governance-sdk` |
| .NET | `Microsoft.AgentGovernance` | `dotnet add package Microsoft.AgentGovernance` |
| Rust | `agent-governance` | `cargo add agent-governance` |
| Go | `agent-governance-toolkit` | `go get github.com/microsoft/agent-governance-toolkit/agent-governance-golang` |

All five SDKs implement core governance (policy, identity, trust, audit); the Python distribution carries the full stack (sandboxing, SRE, compliance tooling). A quick taste of the Rust and TypeScript APIs:

``` js
use agent_governance::{AgentMeshClient, ClientOptions};

let client = AgentMeshClient::new("my-agent").unwrap();
let result = client.execute_with_governance("data.read", None);
js
import { PolicyEngine } from "@microsoft/agent-governance-sdk";

const engine = new PolicyEngine([
  { action: "web_search", effect: "allow" },
  { action: "shell_exec", effect: "deny" },
]);
engine.evaluate("web_search"); // "allow"
engine.evaluate("shell_exec"); // "deny"
```

## The Nine Packages, at a Glance [#](#the-nine-packages-at-a-glance)

| Package | What it does |
|---|---|
Agent OS | Policy engine, agent lifecycle, governance gate |
Agent Control Specification | Stateless, deterministic, fail-closed policy decision runtime (Rust core) |
Agent Mesh | Agent discovery, routing, and trust mesh |
Agent Runtime | Execution sandboxing with four privilege rings |
Agent SRE | Kill switch, SLO monitoring, chaos testing |
Agent Compliance | OWASP verification, policy linting, integrity checks |
Agent Marketplace | Plugin governance and trust scoring |
Agent Lightning | RL training governance with violation penalties |
Agent Hypervisor | Execution audit, delta engine, command denylist enforcement |

Beyond the core packages, AGT also ships an **MCP Security Gateway** (tool poisoning detection, drift monitoring, typosquatting, hidden-instruction scanning), **Shadow AI Discovery** (finding unregistered agents across processes/configs/repos), a real-time **Governance Dashboard**, and a **12-vector PromptDefense Evaluator** for prompt-injection auditing.

## Framework Support [#](#framework-support)

Documented integration, native or adapter-level, spans most of the current agent-framework landscape: **Microsoft Agent Framework** (native middleware), **Semantic Kernel** (native), **AutoGen**, **LangGraph/LangChain**, **CrewAI**, **OpenAI Agents SDK**, **Claude Code** (governance plugin), **Google ADK**, **LlamaIndex**, **Haystack**, **Mastra**, **Dify**, **Azure AI Foundry**, and **GitHub Copilot CLI**.

## Being Honest About What This Doesn’t Cover [#](#being-honest-about-what-this-doesnt-cover)

The Security section of the README is unusually direct for a vendor toolkit: **AGT enforces governance at the application middleware layer, not at the OS kernel level — the policy engine and the agent share the same process boundary.** The stated production recommendation is to still run each agent in a separate container for OS-level isolation on top of AGT’s policy layer.

Supply-chain and code-quality signals backing the project:

| Tool | Coverage |
|---|---|
| CodeQL | Python + TypeScript SAST |
| Gitleaks | Secret scanning on PR/push/weekly |
| ClusterFuzzLite | 7 fuzz targets (policy, injection, MCP, sandbox, trust) |
| Dependabot | 13 ecosystems |
| OpenSSF Scorecard | Weekly scoring + SARIF upload |

A dedicated [Known Limitations](https://github.com/microsoft/agent-governance-toolkit/blob/main/docs/LIMITATIONS.md) doc lays out honest design boundaries and recommended layered defense — worth reading before treating AGT as a complete security solution rather than one layer of one.

## Use Cases [#](#use-cases)

### 1. Multi-Agent Systems Sharing One API Key [#](#1-multi-agent-systems-sharing-one-api-key)

The README’s own framing: “five agents might share a single API key… when something goes wrong, ‘an agent did it’ is not an incident response.” AGT’s identity layer (SPIFFE/DID/mTLS) is specifically aimed at making “which agent did this” answerable.

### 2. Gating Destructive Tool Calls Behind Human Approval [#](#2-gating-destructive-tool-calls-behind-human-approval)

The `require_approval`

policy action (routing an action to named approvers before it executes) fits the common real-world case: an agent should be able to *propose* a destructive or sensitive action without being able to unilaterally *execute* it.

### 3. Auditing MCP Servers for Tool Poisoning [#](#3-auditing-mcp-servers-for-tool-poisoning)

The MCP Security Gateway’s drift monitoring and hidden-instruction scanning target a specific, documented MCP-ecosystem risk class — tools that look benign at review time but change behavior, or hide instructions, later.

### 4. Compliance Evidence for Regulated Deployments [#](#4-compliance-evidence-for-regulated-deployments)

Tamper-evident decision records (what policy was active, what was requested, why it was allowed/denied) are built for exactly the audit conversation the README opens with — “auditors and regulators need tamper-evident records.”

## Related Repositories [#](#related-repositories)

| Repository | Purpose |
|---|---|
|

[Semantic Kernel](https://github.com/microsoft/semantic-kernel)## Related Articles [#](#related-articles)

[MCP Server Security: 10-Server Production Stack](https://dibi8.com/resources/llm-frameworks/mcp-server-security-audit-2026-real-cases/)— pairs directly with AGT’s MCP Security Gateway component[AI Agent Frameworks Compared: LangChain vs CrewAI vs AutoGen vs LlamaIndex vs LangGraph](https://dibi8.com/resources/llm-frameworks/ai-agent-frameworks-comparison-2026/)— AGT integrates with all five as adapters or native middleware

## Conclusion [#](#conclusion)

**Agent Governance Toolkit** treats agent safety as an application-architecture problem, not a prompting problem — every tool call gets intercepted and checked against a deterministic policy before it ever reaches an external system, regardless of what the model “intended.” Backed by real academic citations for why prompt-level safety alone is insufficient, a genuinely broad framework-integration list, and an unusually candid Limitations doc about what the middleware layer doesn’t cover (OS-level isolation still needs containers), it’s a serious entry in the AI-agent-security space rather than a compliance-badge wrapper — just still a Public Preview, not a GA release.

**Best for**: Teams shipping autonomous agents to production who need answers to “was this allowed,” “which agent did it,” and “can you prove it” — especially across a mixed stack of frameworks and languages.

**GitHub**: [https://github.com/microsoft/agent-governance-toolkit](https://github.com/microsoft/agent-governance-toolkit)

*Last updated: 2026-08-02*