🌍 English | 日本語 | 简体中文 | 한국어

Agent Governance Toolkit

📖 Documentation Site · 🚀 Quick Start · 📦 PyPI · 📝 Changelog

[!IMPORTANT] Public Preview — Microsoft-signed, production-quality releases. May have breaking changes before GA. Open a GitHub issue for feedback.

[!TIP] v3.4.0 is out! False-positive fix for contributor reputation check on established accounts, CI lint fixes, and README cleanup. Changelog →

Runtime governance for AI agents -- deterministic policy enforcement, zero-trust identity, execution sandboxing, and SRE for autonomous agents. Covers all 10 OWASP Agentic risks with 13,000+ tests.

Works with any stack — AWS Bedrock, Google ADK, Azure AI, LangChain, CrewAI, AutoGen, OpenAI Agents, and 20+ more. Python · TypeScript · .NET · Rust · Go.

What This Is (and Isn't)

What it does: Sits between your agent framework and the actions agents take. Every tool call, resource access, and inter-agent message is evaluated against policy before execution. Deterministic — not probabilistic.

What it doesn't do: This is not a prompt guardrail or content moderation tool. It governs agent actions, not LLM inputs/outputs. For model-level safety, see Azure AI Content Safety.

Agent Action ──► Policy Check ──► Allow / Deny ──► Audit Log    (< 0.1 ms)

Why it matters: Prompt-based safety ("please follow the rules") has a 26.67% policy violation rate in red-team testing. AGT's deterministic application-layer enforcement: 0.00%.

Get Started in 90 Seconds

# 1. Install
pip install agent-governance-toolkit[full]

# 2. Check your installation
agt doctor

# 3. Verify OWASP compliance
agt verify

# 4. Verify runtime evidence, when available
agt verify --evidence ./agt-evidence.json

# 5. Fail CI on weak runtime evidence
agt verify --evidence ./agt-evidence.json --strict

# 6. Red-team your agent's security posture
agt red-team scan ./prompts/ --min-grade B --strict

Then govern your first action:

from agent_os.policies import PolicyEvaluator, PolicyDocument, PolicyRule, PolicyCondition, PolicyAction, PolicyOperator, PolicyDefaults

evaluator = PolicyEvaluator(policies=[PolicyDocument(
    name="my-policy", version="1.0",
    defaults=PolicyDefaults(action=PolicyAction.ALLOW),
    rules=[PolicyRule(
        name="block-dangerous-tools",
        condition=PolicyCondition(field="tool_name", operator=PolicyOperator.IN, value=["execute_code", "delete_file"]),
        action=PolicyAction.DENY, priority=100,
    )],
)])

result = evaluator.evaluate({"tool_name": "web_search"})    # ✅ Allowed
result = evaluator.evaluate({"tool_name": "delete_file"})   # ❌ Blocked deterministically

import { PolicyEngine } from "@microsoft/agent-governance-sdk";

const engine = new PolicyEngine([
  { action: "web_search", effect: "allow" },
  { action: "shell_exec", effect: "deny" },
]);
engine.evaluate("web_search"); // "allow"
engine.evaluate("shell_exec"); // "deny"

using AgentGovernance;
using AgentGovernance.Extensions.ModelContextProtocol;
using AgentGovernance.Policy;

var kernel = new GovernanceKernel(new GovernanceOptions
{
    PolicyPaths = new() { "policies/default.yaml" },
});

var result = kernel.EvaluateToolCall("did:mesh:agent-1", "web_search",
    new() { ["query"] = "latest AI news" });
// result.Allowed == true

builder.Services
    .AddMcpServer()
    .WithGovernance(options => options.PolicyPaths.Add("policies/mcp.yaml"));

use agent_governance::{AgentMeshClient, ClientOptions};

let client = AgentMeshClient::new("my-agent").unwrap();
let result = client.execute_with_governance("data.read", None);
assert!(result.allowed);

import agentmesh "github.com/microsoft/agent-governance-toolkit/agent-governance-golang"

client, _ := agentmesh.NewClient("my-agent",
    agentmesh.WithPolicyRules([]agentmesh.PolicyRule{
        {Action: "data.read", Effect: agentmesh.Allow},
        {Action: "*", Effect: agentmesh.Deny},
    }),
)
result := client.ExecuteWithGovernance("data.read", nil)
// result.Allowed == true

Full walkthrough: quickstart.md — zero to governed agents in 10 minutes with YAML policies, OPA/Rego, and Cedar support. 🌍 Also available in: 日本語 | 简体中文 | 한국어]

What You Get

Works With Your Stack

Full list: Framework Integrations · Quickstart Examples

OWASP Agentic Top 10 — 10/10 Covered

Full mapping: OWASP-COMPLIANCE.md · Regulatory alignment: EU AI Act, NIST AI RMF, Colorado AI Act

Performance

Governance adds < 0.1 ms per action — roughly 10,000× faster than an LLM API call.

Note: These numbers measure policy evaluation only. In distributed multi-agent deployments, add ~5–50ms for cryptographic verification and mesh handshake on inter-agent messages. See Limitations — Performance for full breakdown.

Full methodology: BENCHMARKS.md

Install

All 5 language packages implement core governance (policy, identity, trust, audit). Python has the full stack. See Language Package Matrix for detailed per-language coverage.

Documentation

Getting Started

• Quick Start — Zero to governed agents in 10 minutes
• Tutorials — 40+ numbered tutorials + 7-chapter Policy-as-Code deep dive
• FAQ — Technical Q&A for customers, partners, and evaluators

Architecture & Reference

• Language Package Matrix — Per-language capability comparison
• Architecture — System design, security model, trust scoring
• Architecture Decisions — ADR log
• Threat Model — Trust boundaries and STRIDE analysis
• API: Agent OS · AgentMesh · Agent SRE

Compliance & Deployment

• Known Limitations — Honest design boundaries and recommended layered defense
• OWASP Compliance — Full ASI-01 through ASI-10 mapping
• Deployment Guides — Azure (AKS, Foundry, Container Apps), AWS (ECS/Fargate), GCP (GKE), Docker Compose
• NIST AI RMF Alignment · EU AI Act · SOC 2 Mapping

Extensions

• VS Code Extension · Framework Integrations

Security

This toolkit provides application-level governance (Python middleware), not OS kernel-level isolation. The policy engine and agents run in the same process — the same trust boundary as every Python agent framework.

Production recommendation: Run each agent in a separate container for OS-level isolation. See Architecture — Security Boundaries.

📖 Known Limitations & Design Boundaries — what AGT does not do, honest performance numbers for distributed deployments, and the recommended layered defense architecture.

Contributing

• Contributing Guide · Community · Security Policy · Changelog

Using AGT? Add your organization to ADOPTERS.md — it helps the project gain momentum and helps others discover real-world use cases.

Important Notes

If you use the Agent Governance Toolkit to build applications that operate with third-party agent frameworks or services, you do so at your own risk. We recommend reviewing all data being shared with third-party services and being cognizant of third-party practices for retention and location of data.

License

This project is licensed under the MIT License.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.