Microsoft Agent Governance Toolkit

Overview

The Microsoft Agent Governance Toolkit (AGT) is an open-source framework for securing autonomous AI agents in production environments. Published by Microsoft, it addresses the critical question: how do you trust an AI agent to take actions on your behalf? The toolkit's philosophy is uncompromising: "Actions the AGT kernel denies are not 'unlikely.' They are structurally impossible."

The toolkit covers all 10 OWASP Agentic Top 10 risks and aligns with NIST AI RMF, EU AI Act, SOC 2, and the Agentic Trust Framework. It provides a complete stack — policy enforcement, zero-trust identity management, execution sandboxing, tamper-evident audit logging, and reliability engineering components.

Available in Python, TypeScript, .NET, Rust, and Go, AGT is the first comprehensive governance framework designed specifically for the agentic AI era, where agents act autonomously rather than simply responding to prompts.

Features

• Policy Engine: Evaluates every agent action against YAML, OPA (Rego), or Cedar policies before execution.
• Identity Management: Zero-trust identity via SPIFFE, DID (Decentralized Identifiers), and mTLS for agent-to-agent authentication.
• Execution Sandboxing: Four privilege rings for runtime isolation — from fully unrestricted to air-gapped.
• Tamper-Evident Audit Logging: Cryptographically verifiable decision records for compliance and forensic analysis.
• MCP Security Gateway: Detects tool poisoning attacks and monitors for drift in MCP server behavior.
• Prompt Defense: 12-vector injection audit capability covering prompt injection, jailbreaking, and indirect injection.
• SRE Components: Kill switch, SLO monitoring, and chaos testing for production reliability.
• Multi-Language SDKs: Native packages for Python, TypeScript, .NET, Rust, and Go.

Installation

# Python
pip install agent-governance-toolkit[full]

# TypeScript / Node.js
npm install @microsoft/agent-governance-sdk

# .NET
dotnet add package Microsoft.AgentGovernance

# Rust
cargo add agent-governance

# Go
go get github.com/microsoft/agent-governance

Quick Start

Govern any tool function in two lines of Python:

from agentmesh.governance import govern

def read_file(path: str) -> str:
    with open(path) as f:
        return f.read()

safe_read = govern(read_file, policy="policy.yaml")

# Policy engine evaluates the call before execution
# Raises GovernanceDenied if the policy blocks it
content = safe_read("data/input.txt")

Example Policy (YAML)

version: "1.0"
policy:
  - action: "read_file"
    allowed_paths:
      - "/data/**"
      - "/workspace/**"
    denied_paths:
      - "/etc/**"
      - "/var/secrets/**"
    require_confirmation:
      - "/workspace/**"
  - action: "execute_shell"
    allowed_commands:
      - "git"
      - "npm"
      - "pip"
    denied_commands:
      - "rm -rf"
      - "sudo"

Core Concepts

• Policy-First Architecture: Every action is evaluated against declarative policies before execution. No policy means no action — defaults are deny-all.
• Layered Stack: Agent → Policy Engine → Identity Verification → Audit Log. Each layer is optional; most teams start with policy enforcement + audit logging.
• Privilege Rings: Four tiers of sandboxing — Ring 0 (full trust) through Ring 3 (air-gapped) — allow fine-grained control over agent capabilities.
• Tamper-Evident Logs: Audit records use chained cryptographic hashes, making it impossible to retroactively alter the decision history.

Advanced Features

MCP Security Gateway

The MCP Security Gateway sits between agents and MCP servers, inspecting every tool call for anomalies. It detects:

• Tool Poisoning: Malicious MCP servers that redefine tool behavior
• Drift Detection: Changes in MCP server schema or behavior over time
• Rate Anomalies: Unusual call patterns that indicate compromise

Prompt Injection Defense

The 12-vector audit system covers:

1. Direct prompt injection
2. Indirect prompt injection (via files, APIs)
3. Jailbreaking attempts
4. Context leakage
5. Role confusion
6. Instruction hijacking
7. Multi-turn injection
8. Encoding obfuscation
9. System prompt extraction
10. Tool argument injection
11. Memory poisoning
12. Cross-session injection

Pros

• ✅ Covers all OWASP Agentic Top 10 risks
• ✅ Backed by Microsoft with strong compliance alignment (NIST, EU AI Act, SOC 2)
• ✅ Multi-language support (Python, TS, .NET, Rust, Go)
• ✅ Policy-first by design — deny by default
• ✅ Production-ready SRE components (kill switch, SLO monitoring)
• ✅ Tamper-evident audit trail for compliance

Cons

• ✅ Significant setup complexity — not trivial to configure correctly
• ✅ Performance overhead from policy evaluation on every call
• ✅ Policy authoring requires learning YAML/OPA/Cedar syntax
• ✅ May be overkill for personal or development-only agents

When to Use

• Deploying autonomous agents in production — AGT is essential for any agent that can take irreversible actions.
• Compliance-driven organizations — the audit trail and standards alignment make AGT ideal for regulated industries.
• Multi-tenant agent platforms — identity management and sandboxing protect against cross-tenant attacks.
• MCP server deployments — the MCP Security Gateway provides defense-in-depth for MCP integrations.

Resources

• Official Repository
• OWASP Agentic Top 10
• NIST AI RMF