Agent Governance Toolkit: Microsoft's Answer to "Which Agent Did This?"

Microsoft released Agent Governance Toolkit (AGT), an MIT-licensed, Public Preview toolkit that enforces policy, identity, sandboxing, and SRE for autonomous AI agents, covering all 10 OWASP Agentic Top 10 risks with a deterministic, fail-closed policy kernel that sits outside the prompt. The toolkit, which has over 5,500 GitHub stars and was updated August 1, 2026, intercepts every tool call in application code before the model's intent reaches the wire, making denied actions structurally impossible. Microsoft cites OWASP LLM01:2025 and Andriushchenko et al. (ICLR 2025) reporting a 100% attack success rate on GPT-4o, GPT-3.5, Claude 3, and Llama-3 using adaptive attacks, arguing that prompt-level safety is insufficient.

Agent Governance Toolkit: Microsoft's Answer to "Which Agent Did This?" Agent Governance Toolkit AGT is Microsoft's MIT-licensed policy enforcement, zero-trust identity, execution sandboxing, and SRE toolkit for autonomous AI agents, covering all 10 OWASP Agentic Top 10 risks with a deterministic, fail-closed policy kernel that sits outside the prompt. - ⭐ 5564 - Python - Rust - TypeScript - MIT - Updated 2026-08-02 MCP Server Security: 10-Server Production Stack https://dibi8.com/resources/llm-frameworks/mcp-server-security-audit-2026-real-cases/ • AI Agent Frameworks Compared: LangChain vs CrewAI vs AutoGen vs LlamaIndex vs LangGraph https://dibi8.com/resources/llm-frameworks/ai-agent-frameworks-comparison-2026/ What Is Agent Governance Toolkit? what-is-agent-governance-toolkit Agent Governance Toolkit AGT is Microsoft’s answer to three questions every team deploying autonomous agents eventually has to answer: Is this action allowed? Which agent did this? Can you prove what happened? Per its own README, it’s “Policy enforcement, identity, sandboxing, and SRE for autonomous AI agents. One pip install , any framework.” 🔗 GitHub : https://github.com/microsoft/agent-governance-toolkit https://github.com/microsoft/agent-governance-toolkit 📖 Docs : microsoft.github.io/agent-governance-toolkit https://microsoft.github.io/agent-governance-toolkit MIT licensed, at 5,500+ GitHub stars , currently labeled Public Preview with a commit from August 1, 2026 , and carrying an “OWASP Agentic Top 10 — 10/10 Covered” badge — a specific, checkable claim rather than vague “enterprise-grade security” marketing. The Argument Against Prompt-Level Safety the-argument-against-prompt-level-safety The README makes its case with citations, not just assertion. It quotes OWASP LLM01:2025 https://genai.owasp.org/llmrisk/llm01-prompt-injection/ stating “it is unclear if there are fool-proof methods of prevention for prompt injection,” and cites Andriushchenko et al. ICLR 2025 https://arxiv.org/abs/2404.02151 reporting a 100% attack success rate on GPT-4o, GPT-3.5, Claude 3, and Llama-3 using adaptive attacks against the JailbreakBench benchmark. It also references Microsoft’s own Lessons from Red Teaming 100 Generative AI Products https://www.microsoft.com/en-us/security/blog/2025/01/13/3-takeaways-from-red-teaming-100-generative-ai-products/ : “mitigations do not eliminate risk entirely.” AGT’s response isn’t to try to win that fight inside the prompt. Every tool call, message send, and delegation is intercepted in deterministic application code before the model’s intent reaches the wire . An action a policy denies isn’t merely unlikely — it’s structurally impossible, because the code path to execute it doesn’t run. Agent ──► Policy Engine ──► Identity ──► Audit Log YAML/OPA/Cedar SPIFFE/DID/mTLS Tamper-evident │ │ ├── Allowed ──► Tool executes │ └── Denied ──► GovernanceDenied │ ▼ Decision Record Every layer is optional — start with govern for policy enforcement and audit logging, and add identity/sandboxing/SRE layers as your risk profile grows. Quickstart: Governing a Tool in Two Lines quickstart-governing-a-tool-in-two-lines pip install "agent-governance-toolkit full " python from agentmesh.governance import govern safe tool = govern my tool, policy="policy.yaml" every call checked, logged, enforced A policy is plain YAML: policy.yaml apiVersion: governance.toolkit/v1 name: production-policy default action: allow rules: - name: block-destructive condition: "action.type in 'drop', 'delete', 'truncate' " action: deny description: "Destructive operations require human approval" - name: require-approval-for-send condition: "action.type == 'send email'" action: require approval approvers: "security-team" safe tool action="read", table="users" {'table': 'users', 'rows': 42} safe tool action="drop", table="users" GovernanceDenied: Action denied by policy rule 'block-destructive': Destructive operations require human approval For Claude Code specifically, governance installs as a plugin: /plugin marketplace add microsoft/agent-governance-toolkit /plugin install agt-governance@agent-governance-toolkit Every Major Language Gets a Real SDK, Not Just Python every-major-language-gets-a-real-sdk-not-just-python | Language | Package | Install | |---|---|---| | Python | agent-governance-toolkit | pip install "agent-governance-toolkit full " | | TypeScript | @microsoft/agent-governance-sdk | npm install @microsoft/agent-governance-sdk | | .NET | Microsoft.AgentGovernance | dotnet add package Microsoft.AgentGovernance | | Rust | agent-governance | cargo add agent-governance | | Go | agent-governance-toolkit | go get github.com/microsoft/agent-governance-toolkit/agent-governance-golang | All five SDKs implement core governance policy, identity, trust, audit ; the Python distribution carries the full stack sandboxing, SRE, compliance tooling . A quick taste of the Rust and TypeScript APIs: js use agent governance::{AgentMeshClient, ClientOptions}; let client = AgentMeshClient::new "my-agent" .unwrap ; let result = client.execute with governance "data.read", None ; js import { PolicyEngine } from "@microsoft/agent-governance-sdk"; const engine = new PolicyEngine { action: "web search", effect: "allow" }, { action: "shell exec", effect: "deny" }, ; engine.evaluate "web search" ; // "allow" engine.evaluate "shell exec" ; // "deny" The Nine Packages, at a Glance the-nine-packages-at-a-glance | Package | What it does | |---|---| Agent OS | Policy engine, agent lifecycle, governance gate | Agent Control Specification | Stateless, deterministic, fail-closed policy decision runtime Rust core | Agent Mesh | Agent discovery, routing, and trust mesh | Agent Runtime | Execution sandboxing with four privilege rings | Agent SRE | Kill switch, SLO monitoring, chaos testing | Agent Compliance | OWASP verification, policy linting, integrity checks | Agent Marketplace | Plugin governance and trust scoring | Agent Lightning | RL training governance with violation penalties | Agent Hypervisor | Execution audit, delta engine, command denylist enforcement | Beyond the core packages, AGT also ships an MCP Security Gateway tool poisoning detection, drift monitoring, typosquatting, hidden-instruction scanning , Shadow AI Discovery finding unregistered agents across processes/configs/repos , a real-time Governance Dashboard , and a 12-vector PromptDefense Evaluator for prompt-injection auditing. Framework Support framework-support Documented integration, native or adapter-level, spans most of the current agent-framework landscape: Microsoft Agent Framework native middleware , Semantic Kernel native , AutoGen , LangGraph/LangChain , CrewAI , OpenAI Agents SDK , Claude Code governance plugin , Google ADK , LlamaIndex , Haystack , Mastra , Dify , Azure AI Foundry , and GitHub Copilot CLI . Being Honest About What This Doesn’t Cover being-honest-about-what-this-doesnt-cover The Security section of the README is unusually direct for a vendor toolkit: AGT enforces governance at the application middleware layer, not at the OS kernel level — the policy engine and the agent share the same process boundary. The stated production recommendation is to still run each agent in a separate container for OS-level isolation on top of AGT’s policy layer. Supply-chain and code-quality signals backing the project: | Tool | Coverage | |---|---| | CodeQL | Python + TypeScript SAST | | Gitleaks | Secret scanning on PR/push/weekly | | ClusterFuzzLite | 7 fuzz targets policy, injection, MCP, sandbox, trust | | Dependabot | 13 ecosystems | | OpenSSF Scorecard | Weekly scoring + SARIF upload | A dedicated Known Limitations https://github.com/microsoft/agent-governance-toolkit/blob/main/docs/LIMITATIONS.md doc lays out honest design boundaries and recommended layered defense — worth reading before treating AGT as a complete security solution rather than one layer of one. Use Cases use-cases 1. Multi-Agent Systems Sharing One API Key 1-multi-agent-systems-sharing-one-api-key The README’s own framing: “five agents might share a single API key… when something goes wrong, ‘an agent did it’ is not an incident response.” AGT’s identity layer SPIFFE/DID/mTLS is specifically aimed at making “which agent did this” answerable. 2. Gating Destructive Tool Calls Behind Human Approval 2-gating-destructive-tool-calls-behind-human-approval The require approval policy action routing an action to named approvers before it executes fits the common real-world case: an agent should be able to propose a destructive or sensitive action without being able to unilaterally execute it. 3. Auditing MCP Servers for Tool Poisoning 3-auditing-mcp-servers-for-tool-poisoning The MCP Security Gateway’s drift monitoring and hidden-instruction scanning target a specific, documented MCP-ecosystem risk class — tools that look benign at review time but change behavior, or hide instructions, later. 4. Compliance Evidence for Regulated Deployments 4-compliance-evidence-for-regulated-deployments Tamper-evident decision records what policy was active, what was requested, why it was allowed/denied are built for exactly the audit conversation the README opens with — “auditors and regulators need tamper-evident records.” Related Repositories related-repositories | Repository | Purpose | |---|---| | Semantic Kernel https://github.com/microsoft/semantic-kernel Related Articles related-articles MCP Server Security: 10-Server Production Stack https://dibi8.com/resources/llm-frameworks/mcp-server-security-audit-2026-real-cases/ — pairs directly with AGT’s MCP Security Gateway component AI Agent Frameworks Compared: LangChain vs CrewAI vs AutoGen vs LlamaIndex vs LangGraph https://dibi8.com/resources/llm-frameworks/ai-agent-frameworks-comparison-2026/ — AGT integrates with all five as adapters or native middleware Conclusion conclusion Agent Governance Toolkit treats agent safety as an application-architecture problem, not a prompting problem — every tool call gets intercepted and checked against a deterministic policy before it ever reaches an external system, regardless of what the model “intended.” Backed by real academic citations for why prompt-level safety alone is insufficient, a genuinely broad framework-integration list, and an unusually candid Limitations doc about what the middleware layer doesn’t cover OS-level isolation still needs containers , it’s a serious entry in the AI-agent-security space rather than a compliance-badge wrapper — just still a Public Preview, not a GA release. Best for : Teams shipping autonomous agents to production who need answers to “was this allowed,” “which agent did it,” and “can you prove it” — especially across a mixed stack of frameworks and languages. GitHub : https://github.com/microsoft/agent-governance-toolkit https://github.com/microsoft/agent-governance-toolkit Last updated: 2026-08-02