Skip to content

Back to the catalog

Microsoft Agent Governance Toolkit
github.comrepo

Microsoft Agent Governance Toolkit

Agent Governance Toolkit (AGT) is a Microsoft open-source framework that intercepts every tool call, message, and delegation made by an AI agent in deterministic application-layer code before it reaches the model, enforcing YAML/OPA/Cedar policies, agent identity (SPIFFE/DID/mTLS), and tamper-evident audit logs. It ships SDKs for Python, TypeScript, .NET, Rust, and Go, a Claude Code plugin, and CLI tools (agt verify, agt red-team scan) for OWASP-style compliance checks and prompt-injection audits. The project explicitly frames prompt-level safety as insufficient, citing a 100% adversarial attack success rate on GPT-4o/Claude 3/Llama-3 (Andriushchenko et al., ICLR 2025) as motivation for application-layer enforcement instead.

TL;DR Microsoft's multi-language toolkit for enforcing deterministic policy, identity, and audit controls on autonomous AI agent tool calls.
Open original ↗
Document

What it is

Microsoft Agent Governance Toolkit (AGT), a Public Preview release ("production-quality... may have breaking changes before GA"). Beyond the enforcement model the summary describes, the page carries the packaging and migration constraints an integrator hits on day one — which distribution to install, what the base wheel does not contain, and a one-way version migration.

Preconditions

  • Python 3.11+.
  • The base agent-governance-toolkit wheel installs only the compliance CLI. The governance modules live in a separate consolidated core distribution. For the quick-start govern() / agentmesh imports you need the [full] extra.

What to do

Install with the full extra to get the runtime modules:

pip install "agent-governance-toolkit[full]"

Govern a tool in two lines (current wrapper API is agentmesh.governance):

from agentmesh.governance import govern
safe_tool = govern(my_tool, policy="policy.yaml")   # every call checked, logged, enforced

Denied calls raise GovernanceDenied. Policy files use apiVersion: governance.toolkit/v1 with a default_action and rules whose action is allow / deny / require_approval (with approvers).

Claude Code integration is via plugin marketplace:

/plugin marketplace add microsoft/agent-governance-toolkit
/plugin install agt-governance@agent-governance-toolkit

Migration gotchas (the actual reason to read the page)

  • agent_os is deprecated. Importing it emits a DeprecationWarning; the old agent-os-kernel distribution is replaced by agent-governance-toolkit-core (included in [full]).
  • The pre-ACS agent_os.policies rule model is gone entirely. Replacements are listed in BREAKING_CHANGES.md.
  • Policy-engine host code now uses the ACS SDK (agent_control_specification.AgentControl).
  • There is a one-way v4→v5 policy migration command provided by agt-policies. Plan for it being non-reversible.

Why enforcement lives in code, not the prompt

The page grounds its "deterministic interception" claim in published failure rates rather than assertion: Andriushchenko et al. (ICLR 2025) report a 100% attack success rate against GPT-4o, GPT-3.5, Claude 3, and Llama-3 using adaptive attacks (logprob access + suffix optimization) on JailbreakBench (Chao et al., NeurIPS 2024). It also cites OWASP LLM01:2025 ("unclear if there are fool-proof methods of prevention for prompt injection"). AGT's stance: intercept every tool call, message, and delegation in application code before intent reaches the wire, making denied actions structurally impossible rather than merely unlikely.

Caveats

Public Preview — expect breaking changes before GA, which the migration tooling above already reflects. The multi-language examples (TypeScript @microsoft/agent-governance-sdk, .NET GovernanceKernel, Rust, Go) expose different, non-unified APIs; only the Python path has the documented migration story.

Organisations named here

  • OWASP LLM01:2025

Technologies named here

  • GPT-4o
  • Agent Governance Toolkit
  • agentmesh.governance.govern
  • GPT-3.5
  • Claude 3
  • agent_control_specification
  • @microsoft/agent-governance-sdk
  • Llama 3
  • AgentGovernance / GovernanceKernel
  • agent_governance
  • agentmesh
  • agt CLI
  • agt-policies
  • Microsoft AI Red Teaming Agent
  • AGT Claude Code plugin
  • Model Context Protocol
  • Claude Code
  • Python
  • TypeScript
  • .NET
  • Go
  • JailbreakBench

Techniques named here

  • Prompt Injection
  • Destructive tool actions
  • Application middleware-layer governance enforcement

Related in AI Security