Microsoft Agent Governance Toolkit: The Open-Source Security Layer Every AI Agent Needs — 5,000+ GitHub Stars

The Problem: AI Agents Are Powerful — and Ungoverned

If you're building AI agents in 2026, you've probably shipped something that can call APIs, query databases, send emails, and delegate tasks to other agents. That's incredible power. But here's the uncomfortable question: what stops your agent from doing something it shouldn't?

Prompt-level safety — asking the model to "please follow the rules" — is not a control surface. It's a polite request to a stochastic system. Research from Andriushchenko et al. (ICLR 2025) demonstrated 100% attack success rate on GPT-4o, GPT-3.5, Claude 3, and Llama-3 using adaptive attacks. Microsoft's own AI Red Teaming Agent formalizes this as Attack Success Rate (ASR), the canonical metric for prompt-level failures.

Your agents need deterministic, structural controls — ones that make misbehavior impossible, not just unlikely. That's exactly what Microsoft's Agent Governance Toolkit provides.

What Is Agent Governance Toolkit (AGT)?

AGT is Microsoft's open-source governance layer for autonomous AI agents. Think of it as a security kernel that sits between your agent's intent and the actual tool execution. Every tool call, message send, and delegation is intercepted in deterministic application code before the model's intent reaches the wire.

Actions the AGT kernel denies aren't "unlikely." They are structurally impossible. That's the difference between asking an agent to behave and making it incapable of misbehaving.

Getting Started in Under 5 Minutes

Installation

AGT supports Python 3.10+, Node.js 18+, .NET 8+, Go 1.25+, and Rust 1.70+. For the full experience:

pip install agent-governance-toolkit[full]

For TypeScript, .NET, Rust, and Go:

# TypeScript
npm install @microsoft/agent-governance-sdk

# .NET
dotnet add package Microsoft.AgentGovernance

# Rust
cargo add agent-governance

# Go
go get github.com/microsoft/agent-governance-toolkit/agent-governance-golang

Govern Any Tool in Two Lines

Here's the simplest possible usage — wrap any function with govern():

from agentmesh.governance import govern

safe_tool = govern(my_tool, policy="policy.yaml")
# Every call is now checked, logged, and enforced

That's it. safe_tool evaluates your YAML policy on every call, logs the decision, and raises GovernanceDenied if the action is blocked.

Define Your Policy in YAML

# policy.yaml
apiVersion: governance.toolkit/v1
name: production-policy
default_action: allow
rules:
  - name: block-destructive
    condition: "action.type in ['drop', 'delete', 'truncate']"
    action: deny
    description: "Destructive operations require human approval"

  - name: require-approval-for-send
    condition: "action.type == 'send_email'"
    action: require_approval
    approvers: ["security-team"]

See It in Action

>>> safe_tool(action="read", table="users")
{'table': 'users', 'rows': 42}

>>> safe_tool(action="drop", table="users")
GovernanceDenied: Action denied by policy rule 'block-destructive':
  Destructive operations require human approval

The Five Pillars of Agent Governance

1. Policy Enforcement (Agent OS)

The core policy engine evaluates every action against your rules. It supports YAML, OPA (Open Policy Agent), and Cedar policy languages. The engine is fail-closed by default — if the policy engine can't reach a decision, the action is denied, not allowed.

from agent_os.policies import (
    PolicyEvaluator, PolicyDocument, PolicyRule,
    PolicyCondition, PolicyAction, PolicyOperator, PolicyDefaults
)

evaluator = PolicyEvaluator(policies=[PolicyDocument(
    name="my-policy", version="1.0",
    defaults=PolicyDefaults(action=PolicyAction.ALLOW),
    rules=[PolicyRule(
        name="block-dangerous-tools",
        condition=PolicyCondition(
            field="tool_name",
            operator=PolicyOperator.IN,
            value=["execute_code", "delete_file"]
        ),
        action=PolicyAction.DENY, priority=100,
    )],
)])

result = evaluator.evaluate({"tool_name": "web_search"})   # Allowed
result = evaluator.evaluate({"tool_name": "delete_file"})  # Blocked

2. Zero-Trust Identity (Agent Mesh)

Every agent gets a cryptographic identity using SPIFFE, DIDs (Decentralized Identifiers), or mTLS certificates. In multi-agent systems where five agents might share a single API key, AGT ensures you can always answer: which agent did this?

3. Execution Sandboxing (Agent Runtime)

Four privilege rings control what agents can actually execute. Think of it like operating system privilege levels — but for AI agents. Ring 0 is full system access; Ring 3 is read-only sandboxed execution.

4. Audit & Compliance (Agent Compliance)

Tamper-evident audit logs using Merkle trees. Every decision — what policy was active, what the agent requested, and why it was allowed or denied — is recorded with cryptographic integrity proofs. This is what regulators and auditors need.

5. Reliability Engineering (Agent SRE)

Kill switches, SLO monitoring, error budgets, chaos testing, and circuit breakers. Because governance isn't just about security — it's about reliability too.

Real-World Example: Governing a Customer Support Agent

Let's say you have an AI agent that handles customer support tickets. It can query your database, send email responses, issue refunds, and escalate to human agents. Here's how you'd govern it:

from agentmesh.governance import govern

# Your existing agent tools
def query_orders(customer_id: str): ...
def send_email(to: str, body: str): ...
def issue_refund(order_id: str, amount: float): ...
def escalate_to_human(ticket_id: str, reason: str): ...

# Govern each tool
safe_query = govern(query_orders, policy="support-policy.yaml")
safe_email = govern(send_email, policy="support-policy.yaml")
safe_refund = govern(issue_refund, policy="support-policy.yaml")
safe_escalate = govern(escalate_to_human, policy="support-policy.yaml")

# support-policy.yaml
apiVersion: governance.toolkit/v1
name: support-agent-policy
default_action: allow
rules:
  - name: cap-refund-amount
    condition: "action.type == 'issue_refund' and action.amount > 100"
    action: require_approval
    approvers: ["finance-team"]
    description: "Refunds over $100 need finance approval"

  - name: block-bulk-emails
    condition: "action.type == 'send_email' and action.recipients_count > 5"
    action: deny
    description: "Bulk emails require marketing review"

  - name: audit-all-refunds
    condition: "action.type == 'issue_refund'"
    action: allow
    audit: true
    description: "Log all refunds for compliance"

Now your support agent can handle routine requests autonomously, but it's structurally impossible for it to issue large refunds without approval, send mass emails, or perform any action without an audit trail.

Framework Compatibility: Works With Everything

One of AGT's strongest features is its universal compatibility. It integrates with every major AI agent framework:

OWASP Agentic Top 10: Full Coverage

AGT is the first open-source toolkit to address all 10 risks in the OWASP Agentic Top 10 — the definitive security standard for AI agent systems. Use the built-in CLI to verify your compliance:

# Check your compliance status
agt verify

# Strict mode for CI/CD pipelines
agt verify --evidence ./agt-evidence.json --strict

# Run prompt injection audits
agt red-team scan ./prompts/ --min-grade B

# Validate policy files
agt lint-policy policies/

Key Benefits

• Deterministic enforcement — Policy decisions happen in application code, not in the model. Denied actions are structurally impossible, not just unlikely.
• Framework agnostic — Works with LangChain, CrewAI, OpenAI Agents SDK, AutoGen, Claude Code, and 10+ more frameworks out of the box.
• Multi-language SDKs — Python, TypeScript, .NET, Rust, and Go. Core governance features are consistent across all five languages.
• OWASP Agentic Top 10 — First open-source toolkit covering all 10 agentic AI security risks with automated compliance verification.
• Zero-trust identity — Cryptographic agent identity (SPIFFE/DID/mTLS) ensures accountability in multi-agent systems.
• Tamper-evident audit trails — Merkle tree-based audit logs with cryptographic integrity proofs for regulatory compliance.
• Fail-closed by default — If the policy engine can't evaluate a request, the action is denied, not allowed.
• MCP Security Gateway — Built-in tool poisoning detection, drift monitoring, typosquatting detection, and hidden instruction scanning.
• MIT licensed — Fully open source with no vendor lock-in.

FAQ