agent-governance-toolkit

Product Introduction

Definition:
The Agent Governance Toolkit (AGT) is an open-source, deterministic policy enforcement framework for autonomous AI agents. It functions as a middleware layer that intercepts every tool call, message send, and delegation in application code before the model’s intent reaches the wire. AGT is designed for production deployments of agentic AI systems and directly addresses the OWASP Agentic Top 10 security risks.

Core Value Proposition:
AGT exists to close the gap between probabilistic prompt-level safety and deterministic runtime control. While prompt-based guardrails are easily bypassed (100% attack success rate reported on leading models), AGT makes unauthorized actions structurally impossible by enforcing policies in the application layer. It answers three critical questions: Is this action allowed? Which agent did this? Can you prove what happened? — enabling secure, auditable, and compliant autonomous agent operations.

Main Features

Policy Engine (Agent OS)
A stateless, fail-closed decision runtime that evaluates tool calls against YAML, OPA, or Cedar policies. Every action is checked against rules such as block-destructive or require-approval-for-send before execution. The engine supports condition expressions, priority-based rule merging, and default actions (allow/deny). It is language-agnostic, with native SDKs in Python, TypeScript, .NET, Rust, and Go. The engine returns a verdict (allow or deny) and logs the decision in a tamper-evident audit trail.

Identity & Trust Mesh (Agent Mesh)
Provides SPIFFE-compliant identity for each agent using DID, mTLS, or SPIFFE standards, solving the “which agent did this?” problem in multi-agent systems. Trust scoring (0–100) modulates policy strictness: low-trust agents face stricter rules. Delegation chains are cryptographically verifiable, preventing impersonation and key sharing.

Sandboxed Execution (Agent Runtime)
Four privilege rings (Ring 0–3) isolate agent actions:

• Ring 0: No restrictions (human-only)
• Ring 1: Read-only data
• Ring 2: Write with policy approval
• Ring 3: Full sandbox (no network, no file write)
  Each agent runs in a container with OS-level isolation; AGT enforces privilege rings within the container process boundary.

Audit & Compliance (Agent Compliance)
Generates tamper-evident Merkle audit logs for each decision, including policy version, action, identity, and verdict. Supports OWASP verification, SOC 2 control mapping, EU AI Act compliance evidence, and NIST AI RMF alignment. The agt verify CLI command produces machine-readable evidence files for CI/CD pipelines.

MCP Security Gateway
Detects tool poisoning, drift monitoring, typosquatting, and hidden instruction injection in Model Context Protocol (MCP) integrations. Scans tool descriptions and payloads for adversarial content before execution.

Multi-Language SDKs
Five production-grade SDKs implement core governance:

• Python (agent-governance-toolkit[full]) – full stack
• TypeScript (@microsoft/agent-governance-sdk) – policy + identity
• .NET (Microsoft.AgentGovernance) – with MCP server integration
• Rust (agent-governance) – zero-cost abstractions
• Go (agent-governance-toolkit/agent-governance-golang)
  All SDKs share the same policy evaluation engine and audit schema.

CLI & Dev Tools
agt doctor checks installation, agt verify runs OWASP compliance checks, agt red-team scan audits prompts for injection vulnerabilities, agt lint-policy validates policy files. Integrates with GitHub Copilot, Claude Code, and OpenCode as governance plugins.

Problems Solved

Pain Point #1: Prompt-level safety is insufficient.
Prompt injections succeed 100% on leading LLMs under adaptive attacks (ICLR 2025). AGT provides deterministic enforcement – if a tool call is denied, it never reaches the tool. This is the difference between “asking” and “making impossible.”

Pain Point #2: Multi-agent identity ambiguity.
When five agents share one API key, incident response fails. AGT assigns cryptographic identities (SPIFFE/DID) to each agent and tracks every action to a specific agent, enabling attribution and blast-radius containment.

Target Audience:

• AI Platform Engineers building agentic infrastructure need to enforce policies across heterogeneous frameworks (LangChain, AutoGen, CrewAI, Semantic Kernel).
• Security Teams responsible for OWASP LLM compliance, SOC 2 audits, and red-teaming agent systems.
• Developers deploying autonomous agents in regulated industries (healthcare, finance, government) require tamper-evident audit trails and fail-closed behavior.
• Site Reliability Engineers (SRE) managing agent fleets need kill switches, SLO monitoring, and chaos testing (Agent SRE component).

Use Cases:

• Financial Services: Block trade-execution agents from sending emails or deleting logs; require human approval for all data exports.
• Healthcare: Ensure patient-data query agents cannot drop tables or access unauthorized PHI; audit every request for HIPAA compliance.
• Enterprise RPA: Govern multi-agent workflows where one agent delegates to another – enforce privilege boundaries and trust thresholds.
• CI/CD Integration: Run agt verify --strict in GitHub Actions to fail builds if policy evidence is weak or vulnerable.

Unique Advantages

Differentiation from Competitors:

• Deterministic vs. Probabilistic: Most competitor solutions rely on prompt engineering or model-level guardrails. AGT intercepts at the application layer, making denial absolute regardless of model behavior.
• Open Policy Agent (OPA) and Cedar Compatibility: AGT’s policy engine can evaluate OPA Rego and Cedar policies natively, allowing reuse of existing cloud-native policy infrastructure.
• Framework Agnostic: Works with 10+ agent frameworks (OpenAI SDK, LangChain, AutoGen, CrewAI, Semantic Kernel, Claude Code, etc.) via adapters, not framework lock-in.
• Zero-Trust Identity: SPIFFE-based identity is cryptographically verifiable, not just a user claim – preventing agent impersonation in mesh topologies.

Key Innovation:
The fail-closed architecture without prompt modification. AGT does not inject system prompts or rely on model compliance. Instead, it operates as a middleware gate that evaluates all tool calls against a separate deterministic policy engine. This decoupling means policy updates do not require model retraining or prompt iteration, and the policy engine itself is fuzz-tested (7 fuzz targets) and has 992 conformance tests.

Standalone compliance automation: The Agent Compliance module maps decisions to OWASP Top 10, NIST AI RMF, EU AI Act, and SOC 2 automatically, producing ready-to-audit evidence files.

Frequently Asked Questions (FAQ)

Q: How does Agent Governance Toolkit differ from simple prompt injection filters?
A: Prompt filters are probabilistic and have proven bypass rates (100% for known attacks). AGT enforces policies in deterministic application code before any model output reaches a tool. Every denied action is structurally impossible, not just “unlikely.”

Q: Can I use AGT with my existing LangGraph or CrewAI agents without rewriting them?
A: Yes. AGT provides adapters for LangGraph, CrewAI, OpenAI Agents SDK, Semantic Kernel, and others. You wrap your tool functions with govern() or add a middleware – no agent core changes required.

Q: Does AGT require Microsoft Azure to run?
A: No. AGT is 100% open-source and runs anywhere. Azure-integrated features (like managed identity) are optional; the core policy engine, identity, and audit layers work with any cloud or on-premises infrastructure.

Q: What is the performance overhead of adding governance to every tool call?
A: The Rust-based core policy engine evaluates a typical rule in under 1ms per call. For most production workloads the overhead is negligible. The fuzz targets and performance benchmarks are included in the repository.

Q: How do I audit multi-agent conversations after an incident?
A: AGT logs every decision (policy version, action, identity, verdict) to a tamper-evident Merkle tree. The agt verify command exports a Decision Bill of Materials (BOM) that you can replay and verify against the audit logs.