{"id":22833,"date":"2007-02-10T12:44:27","date_gmt":"2007-02-10T12:44:27","guid":{"rendered":"https:\/\/scannn.com\/microsoft-agent-governance-toolkit-ai-agent-governance-toolkit-policy-enforcement-zero-trust-identity-execution-sandboxing-and-reliability-engineering-for-autonomous-ai-agents-covers-10\/"},"modified":"2007-02-10T12:44:27","modified_gmt":"2007-02-10T12:44:27","slug":"microsoft-agent-governance-toolkit-ai-agent-governance-toolkit-policy-enforcement-zero-trust-identity-execution-sandboxing-and-reliability-engineering-for-autonomous-ai-agents-covers-10","status":"publish","type":"post","link":"https:\/\/scannn.com\/lv\/microsoft-agent-governance-toolkit-ai-agent-governance-toolkit-policy-enforcement-zero-trust-identity-execution-sandboxing-and-reliability-engineering-for-autonomous-ai-agents-covers-10\/","title":{"rendered":"microsoft\/agent-governance-toolkit: AI Agent Governance Toolkit \u2014 Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10\/10 OWASP Agentic Top 10. \u00b7 GitHub"},"content":{"rendered":"\n
\n

English<\/a> | \u65e5\u672c\u8a9e<\/a> | \u7b80\u4f53\u4e2d\u6587<\/a> | \ud55c\uad6d\uc5b4<\/a><\/p>\n

<\/a><\/p>\n

\n

Ship agents to production without losing sleep<\/h3>\n

<\/svg><\/a><\/div>\n

\n
\n \"Full
\n <\/a>\n<\/p>\n

\n
\n Quick Start<\/a> \u00b7
\n Specifications<\/a> \u00b7
\n PyPI<\/a> \u00b7
\n Changelog<\/a>
\n <\/strong>\n<\/p>\n

\"CI\"<\/a>
\n\"Discord\"<\/a>
\n\"License:<\/a>
\n\"PyPI<\/a>
\n\"npm\"<\/a>
\n\"NuGet\"<\/a>
\n\"OpenSSF<\/a>
\n\"OpenSSF<\/a>
\n\"OWASP<\/a>
\n\"AARM<\/a>
\n\"ATF\"<\/a><\/p>\n

\n

<\/svg>Important<\/p>\n

Public Preview<\/strong> — production-quality public preview releases. May have breaking changes before GA.<\/p>\n<\/div>\n

Policy enforcement, identity, sandboxing, and SRE for autonomous AI agents. One pip install<\/code>, any framework.<\/p>\n\n

Your AI agents call tools, browse the web, query databases, and delegate to other agents. Once deployed, they make decisions autonomously. You need answers to three questions:<\/p>\n

1. Is this action allowed?<\/strong> An agent with access to send_email<\/code> and query_database<\/code> should not be able to drop_table<\/code>. OAuth scopes and IAM roles control which services an agent can reach, not what it does once connected.<\/p>\n

2. Which agent did this?<\/strong> In a multi-agent system, five agents might share a single API key. When something goes wrong, “an agent did it” is not an incident response.<\/p>\n

3. Can you prove what happened?<\/strong> Auditors and regulators need tamper-evident records of every decision: what policy was active, what the agent requested, and why it was allowed or denied.<\/p>\n

Prompt-level safety (“please follow the rules”) is not a control surface. It is a polite request to a stochastic system. OWASP LLM01:2025<\/a> states this explicitly: “it is unclear if there are fool-proof methods of prevention for prompt injection.”<\/em> The published numbers back this up. Andriushchenko et al. (ICLR 2025)<\/a> report 100% attack success rate<\/strong> on GPT-4o, GPT-3.5, Claude 3, and Llama-3 using adaptive attacks with logprob access and suffix optimization, evaluated against the JailbreakBench<\/a> benchmark (Chao et al., NeurIPS 2024). Microsoft’s own AI Red Teaming Agent<\/a> formalizes Attack Success Rate (ASR)<\/strong>, the rate of policy violations under adversarial input, as the canonical metric for this class of failure. Lessons from Red Teaming 100 Generative AI Products<\/em><\/a> reinforces the point: “mitigations do not eliminate risk entirely”<\/em> and red teaming must be a continuous process because model-layer defenses are probabilistic by construction.<\/p>\n

AGT does not try to win that fight inside the prompt. Every tool call, message send, and delegation is intercepted in deterministic application code before<\/em> the model’s intent reaches the wire. Actions the AGT kernel denies are not “unlikely.” They are structurally impossible<\/strong>. That is the difference between asking an agent to behave and making it incapable of misbehaving.<\/p>\n\n

Prerequisites:<\/strong> Python 3.10+<\/p>\n

\n
pip install agent-governance-toolkit[full]<\/pre>\n<\/div>\n
Use the [full]<\/code> extra for the quick-start imports below. The base
\nagent-governance-toolkit<\/code> wheel installs the compliance CLI only; the governance
\nmodules live in the consolidated core distribution. The agentmesh<\/code> quick-start
\nimport remains the current wrapper API. The agent_os<\/code> PolicyEvaluator<\/code> example
\nbelow is legacy compatibility: importing agent_os<\/code> currently emits a
\nDeprecationWarning<\/code> because the old agent-os-kernel<\/code> distribution is deprecated.
\nUse agent-governance-toolkit-core<\/code> (or the [full]<\/code> extra that includes it) as
\nthe replacement distribution, and prefer the AGT 5 agt-policies<\/code>\/ACS APIs for
\nnew policy-engine host code.<\/p>\n
For Claude Code, add AGT as a plugin marketplace and install the governance plugin:<\/p>\n
\n
\/plugin marketplace add microsoft\/agent-governance-toolkit\n\/plugin install agt-governance@agent-governance-toolkit\n<\/code><\/pre>\n<\/div>\n
Govern any tool function in two lines:<\/p>\n
\n
from<\/span> agentmesh<\/span>.governance<\/span> import<\/span> govern<\/span>\n\nsafe_tool<\/span> =<\/span> govern<\/span>(my_tool<\/span>, policy<\/span>=<\/span>\"policy.yaml\"<\/span>)   # every call checked, logged, enforced<\/span><\/pre>\n<\/div>\n
That’s it. safe_tool<\/code> evaluates your YAML policy on every call, logs the decision, and raises GovernanceDenied<\/code> if the action is blocked.<\/p>\n
\n
#<\/span> policy.yaml<\/span>\napiVersion<\/span>: governance.toolkit\/v1<\/span>\nname<\/span>: production-policy<\/span>\ndefault_action<\/span>: allow<\/span>\nrules<\/span>:\n  - name<\/span>: block-destructive<\/span>\n    condition<\/span>: \"<\/span>action.type in ['drop', 'delete', 'truncate']\"<\/span><\/span>\n    action<\/span>: deny<\/span>\n    description<\/span>: \"<\/span>Destructive operations require human approval\"<\/span><\/span>\n\n  - name<\/span>: require-approval-for-send<\/span>\n    condition<\/span>: \"<\/span>action.type == 'send_email'\"<\/span><\/span>\n    action<\/span>: require_approval<\/span>\n    approvers<\/span>: [\"security-team\"]<\/span><\/pre>\n<\/div>\n
\n
><\/span>>><\/span> safe_tool<\/span>(action<\/span>=<\/span>\"read\"<\/span>, table<\/span>=<\/span>\"users\"<\/span>)\n{'table'<\/span>: 'users'<\/span>, 'rows'<\/span>: 42<\/span>}\n\n><\/span>>><\/span> safe_tool<\/span>(action<\/span>=<\/span>\"drop\"<\/span>, table<\/span>=<\/span>\"users\"<\/span>)\nGovernanceDenied<\/span>: Action<\/span> denied<\/span> by<\/span> policy<\/span> rule<\/span> 'block-destructive'<\/span>:\n  Destructive<\/span> operations<\/span> require<\/span> human<\/span> approval<\/span><\/pre>\n<\/div>\n
Or use the full PolicyEvaluator<\/code> API for programmatic control:<\/p>\n
\nPolicyEvaluator example<\/b><\/summary>\n
\n
from<\/span> agent_os<\/span>.policies<\/span> import<\/span> (\n    PolicyEvaluator<\/span>, PolicyDocument<\/span>, PolicyRule<\/span>,\n    PolicyCondition<\/span>, PolicyAction<\/span>, PolicyOperator<\/span>, PolicyDefaults<\/span>\n)\n\nevaluator<\/span> =<\/span> PolicyEvaluator<\/span>(policies<\/span>=<\/span>[PolicyDocument<\/span>(\n    name<\/span>=<\/span>\"my-policy\"<\/span>, version<\/span>=<\/span>\"1.0\"<\/span>,\n    defaults<\/span>=<\/span>PolicyDefaults<\/span>(action<\/span>=<\/span>PolicyAction<\/span>.ALLOW<\/span>),\n    rules<\/span>=<\/span>[PolicyRule<\/span>(\n        name<\/span>=<\/span>\"block-dangerous-tools\"<\/span>,\n        condition<\/span>=<\/span>PolicyCondition<\/span>(\n            field<\/span>=<\/span>\"tool_name\"<\/span>,\n            operator<\/span>=<\/span>PolicyOperator<\/span>.IN<\/span>,\n            value<\/span>=<\/span>[\"execute_code\"<\/span>, \"delete_file\"<\/span>]\n        ),\n        action<\/span>=<\/span>PolicyAction<\/span>.DENY<\/span>, priority<\/span>=<\/span>100<\/span>,\n    )],\n)])\n\nresult<\/span> =<\/span> evaluator<\/span>.evaluate<\/span>({\"tool_name\"<\/span>: \"web_search\"<\/span>})    # Allowed<\/span>\nresult<\/span> =<\/span> evaluator<\/span>.evaluate<\/span>({\"tool_name\"<\/span>: \"delete_file\"<\/span>})   # Blocked<\/span><\/pre>\n<\/div>\n<\/details>\n
\nTypeScript \/ .NET \/ Rust \/ Go examples<\/b><\/summary>\n
TypeScript<\/strong><\/p>\n
\n
import<\/span> {<\/span> PolicyEngine<\/span> }<\/span> from<\/span> \"@microsoft\/agent-governance-sdk\"<\/span>;<\/span>\n\nconst<\/span> engine<\/span> =<\/span> new<\/span> PolicyEngine<\/span>(<\/span>[<\/span>\n  {<\/span> action<\/span>: \"web_search\"<\/span>,<\/span> effect<\/span>: \"allow\"<\/span> }<\/span>,<\/span>\n  {<\/span> action<\/span>: \"shell_exec\"<\/span>,<\/span> effect<\/span>: \"deny\"<\/span> }<\/span>,<\/span>\n]<\/span>)<\/span>;<\/span>\nengine<\/span>.<\/span>evaluate<\/span>(<\/span>\"web_search\"<\/span>)<\/span>;<\/span> \/\/ \"allow\"<\/span>\nengine<\/span>.<\/span>evaluate<\/span>(<\/span>\"shell_exec\"<\/span>)<\/span>;<\/span> \/\/ \"deny\"<\/span><\/pre>\n<\/div>\n
.NET<\/strong><\/p>\n
\n
using<\/span> AgentGovernance<\/span>;<\/span>\nusing<\/span> AgentGovernance<\/span>.<\/span>Extensions<\/span>.<\/span>ModelContextProtocol<\/span>;<\/span>\nusing<\/span> AgentGovernance<\/span>.<\/span>Policy<\/span>;<\/span>\n\nvar<\/span> kernel<\/span> =<\/span> new<\/span> GovernanceKernel<\/span>(<\/span>new<\/span> GovernanceOptions<\/span>\n{<\/span>\n    PolicyPaths<\/span> =<\/span> new<\/span>(<\/span>)<\/span> {<\/span> \"policies\/default.yaml\"<\/span> }<\/span>,<\/span>\n}<\/span>)<\/span>;<\/span>\nvar<\/span> result<\/span> =<\/span> kernel<\/span>.<\/span>EvaluateToolCall<\/span>(<\/span>\"did:mesh:agent-1\"<\/span>,<\/span> \"web_search\"<\/span>,<\/span>\n    new<\/span>(<\/span>)<\/span> {<\/span> [<\/span>\"query\"<\/span>]<\/span> =<\/span> \"latest AI news\"<\/span> }<\/span>)<\/span>;<\/span>\n\n\/\/ MCP server integration<\/span>\nbuilder<\/span>.<\/span>Services<\/span>.<\/span>AddMcpServer<\/span>(<\/span>)<\/span>\n    .<\/span>WithGovernance<\/span>(<\/span>options =><\/span> options<\/span>.<\/span>PolicyPaths<\/span>.<\/span>Add<\/span>(<\/span>\"policies\/mcp.yaml\"<\/span>)<\/span>)<\/span>;<\/span><\/pre>\n<\/div>\n
Rust<\/strong><\/p>\n
\n
use<\/span> agent_governance::<\/span>{<\/span>AgentMeshClient<\/span>,<\/span> ClientOptions<\/span>}<\/span>;<\/span>\n\nlet<\/span> client = AgentMeshClient<\/span>::<\/span>new<\/span>(<\/span>\"my-agent\"<\/span>)<\/span>.<\/span>unwrap<\/span>(<\/span>)<\/span>;<\/span>\nlet<\/span> result = client.<\/span>execute_with_governance<\/span>(<\/span>\"data.read\"<\/span>,<\/span> None<\/span>)<\/span>;<\/span>\nassert<\/span>!<\/span>(<\/span>result.<\/span>allowed)<\/span>;<\/span><\/pre>\n<\/div>\n
Go<\/strong><\/p>\n
\n
import<\/span> agentmesh \"github.com\/microsoft\/agent-governance-toolkit\/agent-governance-golang\"<\/span>\n\nclient<\/span>, _<\/span> :=<\/span> agentmesh<\/span>.NewClient<\/span>(\"my-agent\"<\/span>,\n    agentmesh<\/span>.WithPolicyRules<\/span>([]agentmesh.PolicyRule<\/span>{\n        {Action<\/span>: \"data.read\"<\/span>, Effect<\/span>: agentmesh<\/span>.Allow<\/span>},\n        {Action<\/span>: \"*\"<\/span>, Effect<\/span>: agentmesh<\/span>.Deny<\/span>},\n    }),\n)\nresult<\/span> :=<\/span> client<\/span>.ExecuteWithGovernance<\/span>(\"data.read\"<\/span>, nil<\/span>)<\/pre>\n<\/div>\n<\/details>\n
CLI tools:<\/p>\n
\n
agt doctor                                        #<\/span> check installation<\/span>\nagt verify                                        #<\/span> OWASP compliance check<\/span>\nagt verify --evidence .\/agt-evidence.json --strict #<\/span> fail CI on weak evidence<\/span>\nagt red-team scan .\/prompts\/ --min-grade B         #<\/span> prompt injection audit<\/span>\nagt lint-policy policies\/                          #<\/span> validate policy files<\/span><\/pre>\n<\/div>\n
Full walkthrough: quickstart.md<\/a> — zero to governed agents in 5 minutes.
\n Also in: \u65e5\u672c\u8a9e<\/a> | \u7b80\u4f53\u4e2d\u6587<\/a> | \ud55c\uad6d\uc5b4<\/a><\/p>\n\n
\n
Agent \u2500\u2500\u25ba Policy Engine \u2500\u2500\u25ba Identity \u2500\u2500\u25ba Audit Log\n            (YAML\/OPA\/Cedar)  (SPIFFE\/DID\/mTLS)  (Tamper-evident)\n                 \u2502                                      \u2502\n                 \u251c\u2500\u2500 Allowed \u2500\u2500\u25ba Tool executes           \u2502\n                 \u2514\u2500\u2500 Denied  \u2500\u2500\u25ba GovernanceDenied        \u2502\n                                                        \u25bc\n                                                 Decision Record\n<\/code><\/pre>\n<\/div>\n
Every layer is optional. Start with govern()<\/code> and add layers as your risk profile grows. Most teams run policy enforcement + audit logging and never need the full stack.<\/p>\n\n
<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Package<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
Agent OS<\/strong><\/a><\/td>\nPolicy engine, agent lifecycle, governance gate<\/td>\n<\/tr>\n
Agent Control Specification<\/strong><\/a> (README<\/a>)<\/td>\nStateless, deterministic, fail-closed policy decision runtime (Rust core) backing the AGT policy layer<\/td>\n<\/tr>\n
Agent Mesh<\/strong><\/a><\/td>\nAgent discovery, routing, and trust mesh<\/td>\n<\/tr>\n
Agent Runtime<\/strong><\/a><\/td>\nExecution sandboxing with four privilege rings<\/td>\n<\/tr>\n
Agent SRE<\/strong><\/a><\/td>\nKill switch, SLO monitoring, chaos testing<\/td>\n<\/tr>\n
Agent Compliance<\/strong><\/a><\/td>\nOWASP verification, policy linting, integrity checks<\/td>\n<\/tr>\n
Agent Marketplace<\/strong><\/a><\/td>\nPlugin governance and trust scoring<\/td>\n<\/tr>\n
Agent Lightning<\/strong><\/a><\/td>\nRL training governance with violation penalties<\/td>\n<\/tr>\n
Agent Hypervisor<\/strong><\/a><\/td>\nExecution audit, delta engine, in-memory commitment tracking, command denylist enforcement<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/markdown-accessiblity-table><\/p>\n
<\/p>\n\n\n\n\n\n\n\n\n\n
Capability<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
MCP Security Gateway<\/strong><\/td>\nTool poisoning detection, drift monitoring, typosquatting, hidden instruction scanning (Spec<\/a>)<\/td>\n<\/tr>\n
Shadow AI Discovery<\/strong><\/td>\nFind unregistered agents across processes, configs, and repos (Discovery<\/a>)<\/td>\n<\/tr>\n
Governance Dashboard<\/strong><\/td>\nReal-time fleet visibility for health, trust, and compliance (Dashboard<\/a>)<\/td>\n<\/tr>\n
PromptDefense Evaluator<\/strong><\/td>\n12-vector prompt injection audit (Evaluator<\/a>)<\/td>\n<\/tr>\n
Contributor Reputation<\/strong><\/td>\nPR\/issue author screening for social engineering. Reusable GitHub Action (Action<\/a>)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/markdown-accessiblity-table><\/p>\n\n
<\/p>\n
All five language SDKs implement core governance (policy, identity, trust, audit). Python has the full stack. Copilot CLI and Claude Code are first-party developer surfaces built on the TypeScript SDK.
\nSee Language Package Matrix<\/a><\/strong> for detailed per-language coverage.<\/p>\n
\nPython distributions (v4.1.0 \u2014 consolidated)<\/b><\/summary>\n
As of v4.1.0, 45 packages have been consolidated into 5 top-level distributions:<\/p>\n
<\/p>\n\n\n\n\n\n\n\n\n\n
Distribution<\/th>\nPyPI<\/th>\nWhat’s included<\/th>\n<\/tr>\n<\/thead>\n
agent-governance-toolkit-core<\/code><\/td>\nagent-governance-toolkit-core<\/code><\/a><\/td>\nPolicy engine, capability model, audit, MCP gateway, zero-trust identity, trust scoring, A2A\/MCP\/IATP bridges<\/td>\n<\/tr>\n
agent-governance-toolkit-runtime<\/code><\/td>\nagent-governance-toolkit-runtime<\/code><\/a><\/td>\nPrivilege rings, saga orchestration, termination control, execution plan validation, command denylist enforcement<\/td>\n<\/tr>\n
agent-governance-toolkit-sre<\/code><\/td>\nagent-governance-toolkit-sre<\/code><\/a><\/td>\nSLOs, error budgets, chaos engineering, circuit breakers<\/td>\n<\/tr>\n
agent-governance-toolkit-cli<\/code><\/td>\nagent-governance-toolkit-cli<\/code><\/a><\/td>\nagt<\/code> CLI, OWASP verification, integrity checks, policy linting<\/td>\n<\/tr>\n
agent-governance-toolkit[full]<\/code><\/td>\nagent-governance-toolkit<\/code><\/a><\/td>\nMeta-package installing all of the above<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
<\/markdown-accessiblity-table><\/p>\n
Previous package names (agent-os-kernel<\/code>, agentmesh-platform<\/code>, agentmesh-runtime<\/code>, agent-sre<\/code>, agent-discovery<\/code>, agent-hypervisor<\/code>, agentmesh-marketplace<\/code>, agentmesh-lightning<\/code>) remain installable as stub packages that redirect to the consolidated distributions.<\/p>\n<\/details>\n