🌍 English | 日本語 | 简体中文 | 한국어
Ship agents to production without losing sleep
🚀 Quick Start ·
📋 Specifications ·
📦 PyPI ·
📝 Changelog
-brightgreen)
[!IMPORTANT]
Public Preview -- production-quality public preview releases. May have breaking changes before GA.
Policy enforcement, identity, sandboxing, and SRE for autonomous AI agents. One pip install, any framework.
The Problem
Your AI agents call tools, browse the web, query databases, and delegate to other agents. Once deployed, they make decisions autonomously. You need answers to three questions:
1. Is this action allowed? An agent with access to send_email and query_database should not be able to drop_table. OAuth scopes and IAM roles control which services an agent can reach, not what it does once connected.
2. Which agent did this? In a multi-agent system, five agents might share a single API key. When something goes wrong, "an agent did it" is not an incident response.
3. Can you prove what happened? Auditors and regulators need tamper-evident records of every decision: what policy was active, what the agent requested, and why it was allowed or denied.
Prompt-level safety ("please follow the rules") is not a control surface. It is a polite request to a stochastic system. OWASP LLM01:2025 states this explicitly: "it is unclear if there are fool-proof methods of prevention for prompt injection." The published numbers back this up. Andriushchenko et al. (ICLR 2025) report 100% attack success rate on GPT-4o, GPT-3.5, Claude 3, and Llama-3 using adaptive attacks with logprob access and suffix optimization, evaluated against the JailbreakBench benchmark (Chao et al., NeurIPS 2024). Microsoft's own AI Red Teaming Agent formalizes Attack Success Rate (ASR), the rate of policy violations under adversarial input, as the canonical metric for this class of failure. Lessons from Red Teaming 100 Generative AI Products reinforces the point: "mitigations do not eliminate risk entirely" and red teaming must be a continuous process because model-layer defenses are probabilistic by construction.
AGT does not try to win that fight inside the prompt. Every tool call, message send, and delegation is intercepted in deterministic application code before the model's intent reaches the wire. Actions the AGT kernel denies are not "unlikely." They are structurally impossible. That is the difference between asking an agent to behave and making it incapable of misbehaving.
Quick Start
Prerequisites: Python 3.11+
pip install "agent-governance-toolkit[full]"
Use the [full] extra for the quick-start imports below. The base
agent-governance-toolkit wheel installs the compliance CLI only; the governance
modules live in the consolidated core distribution. The agentmesh quick-start
import remains the current wrapper API. Importing agent_os emits a
DeprecationWarning because the old agent-os-kernel distribution is deprecated.
Use agent-governance-toolkit-core (or the [full] extra that includes it) as
the replacement distribution. Policy-engine host code uses the ACS SDK;
agt-policies provides the one-way v4-to-v5 migration command. The pre-ACS
agent_os.policies rule model is gone, and BREAKING_CHANGES.md lists its
replacements.
For Claude Code, add AGT as a plugin marketplace and install the governance plugin:
/plugin marketplace add microsoft/agent-governance-toolkit
/plugin install agt-governance@agent-governance-toolkit
Govern any tool function in two lines:
from agentmesh.governance import govern
safe_tool = govern(my_tool, policy="policy.yaml") # every call checked, logged, enforced
On every call, safe_tool evaluates the YAML policy, logs the decision to an
audit trail, and raises GovernanceDenied when the policy blocks the action.
# policy.yaml
apiVersion: governance.toolkit/v1
name: production-policy
default_action: allow
rules:
- name: block-destructive
condition: "action.type in ['drop', 'delete', 'truncate']"
action: deny
description: "Destructive operations require human approval"
- name: require-approval-for-send
condition: "action.type == 'send_email'"
action: require_approval
approvers: ["security-team"]
>>> safe_tool(action="read", table="users")
{'table': 'users', 'rows': 42}
>>> safe_tool(action="drop", table="users")
GovernanceDenied: Action denied by policy rule 'block-destructive':
Destructive operations require human approval
Or use the full AgentControl API for programmatic control:
AgentControl example
from agent_control_specification import AgentControl
runtime = AgentControl.from_path(str("manifest.yaml"))
result = runtime.evaluate(
"input",
{
"envelope": {"agent_id": "example-agent"},
"input": {"body": {"action": "web_search", "params": {}}},
},
)
print(result.verdict)
runtime.close()
Run the complete ACS email-tool example.
TypeScript / .NET / Rust / Go examples
TypeScript
import { PolicyEngine } from "@microsoft/agent-governance-sdk";
const engine = new PolicyEngine([
{ action: "web_search", effect: "allow" },
{ action: "shell_exec", effect: "deny" },
]);
engine.evaluate("web_search"); // "allow"
engine.evaluate("shell_exec"); // "deny"
.NET
using AgentGovernance;
using AgentGovernance.Extensions.ModelContextProtocol;
using AgentGovernance.Policy;
var kernel = new GovernanceKernel(new GovernanceOptions
{
PolicyPaths = new() { "policies/default.yaml" },
});
var result = kernel.EvaluateToolCall("did:mesh:agent-1", "web_search",
new() { ["query"] = "latest AI news" });
// MCP server integration
builder.Services.AddMcpServer()
.WithGovernance(options => options.PolicyPaths.Add("policies/mcp.yaml"));
Rust
use agent_governance::{AgentMeshClient, ClientOptions};
let client = AgentMeshClient::new("my-agent").unwrap();
let result = client.execute_with_governance("data.read", None);
assert!(result.allowed);
Go
import agentmesh "github.com/microsoft/agent-governance-toolkit/agent-governance-golang"
client, _ := agentmesh.NewClient("my-agent",
agentmesh.WithPolicyRules([]agentmesh.PolicyRule{
{Action: "data.read", Effect: agentmesh.Allow},
{Action: "*", Effect: agentmesh.Deny},
}),
)
result := client.ExecuteWithGovernance("data.read", nil)
CLI tools:
agt doctor # check installation
agt verify # OWASP compliance check
agt verify --evidence ./agt-evidence.json --strict # fail CI on weak evidence
agt red-team scan ./prompts/ --min-grade B # prompt injection audit
agt lint-policy policies/ # validate policy files
Full walkthrough: quickstart.md -- zero to governed agents in 5 minutes.
🌍 Also in: 日本語 | 简体中文 | 한국어
How It Works
Agent ──► Policy Engine ──► Identity ──► Audit Log
(YAML/OPA/Cedar) (SPIFFE/DID/mTLS) (Tamper-evident)
│ │
├── Allowed ──► Tool executes │
└── Denied ──► GovernanceDenied │
▼
Decision Record
Every layer is optional. Start with govern() and add layers as your risk profile grows. Most teams run policy enforcement + audit logging and never need the full stack.
Packages
| Package |
Description |
| Agent OS |
Policy engine, agent lifecycle, governance gate |
| Agent Control Specification (README) |
Stateless, deterministic, fail-closed policy decision runtime (Rust core) backing the AGT policy layer |
| Agent Mesh |
Agent discovery, routing, and trust mesh |
| Agent Runtime |
Execution sandboxing with four privilege rings |
| Agent SRE |
Kill switch, SLO monitoring, chaos testing |
| Agent Compliance |
OWASP verification, policy linting, integrity checks |
| Agent Marketplace |
Plugin governance and trust scoring |
| Agent Lightning |
RL training governance with violation penalties |
| Agent Hypervisor |
Execution audit, delta engine, in-memory commitment tracking, command denylist enforcement |
Additional Capabilities
| Capability |
Description |
| MCP Security Gateway |
Tool poisoning detection, drift monitoring, typosquatting, hidden instruction scanning (Spec) |
| Shadow AI Discovery |
Find unregistered agents across processes, configs, and repos (Discovery) |
| Governance Dashboard |
Real-time fleet visibility for health, trust, and compliance (Dashboard) |
| PromptDefense Evaluator |
12-vector prompt injection audit (Evaluator) |
| Contributor Reputation |
PR/issue author screening for social engineering. Reusable GitHub Action (Action) |
Install
All five language SDKs implement core governance (policy, identity, trust, audit). Python has the full stack. Copilot CLI and Claude Code are first-party developer surfaces built on the TypeScript SDK.
See Language Package Matrix for detailed per-language coverage.
Python distributions (v4.1.0 — consolidated)
As of v4.1.0, 45 packages have been consolidated into 5 top-level distributions:
| Distribution |
PyPI |
What's included |
agent-governance-toolkit-core |
agent-governance-toolkit-core |
Policy engine, capability model, audit, MCP gateway, zero-trust identity, trust scoring, A2A/MCP/IATP bridges |
agent-governance-toolkit-runtime |
agent-governance-toolkit-runtime |
Privilege rings, saga orchestration, termination control, execution plan validation, command denylist enforcement |
agent-governance-toolkit-sre |
agent-governance-toolkit-sre |
SLOs, error budgets, chaos engineering, circuit breakers |
agent-governance-toolkit-cli |
agent-governance-toolkit-cli |
agt CLI, OWASP verification, integrity checks, policy linting |
agent-governance-toolkit[full] |
agent-governance-toolkit |
Meta-package installing all of the above |
Previous package names (agent-os-kernel, agentmesh-platform, agentmesh-runtime, agent-sre, agent-discovery, agent-hypervisor, agentmesh-marketplace, agentmesh-lightning) remain installable as stub packages that redirect to the consolidated distributions.
Prerequisites
- Python: 3.10+
- Node.js: 18+ / npm 9+ (TypeScript SDK)
- .NET: 8+
- Go: 1.25+
- Rust: 1.70+
- Optional:
AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET for Azure-integrated features
Framework Support
Full list: Framework Integrations · Quickstart Examples
Examples
Specifications
Every major component has a formal RFC 2119 specification with conformance tests. These specs define the behavioral contract: what implementations MUST, SHOULD, and MAY do.
| Specification |
Scope |
Tests |
| Agent OS Policy Engine |
Native runtime integration and fail-closed semantics |
-- |
| Agent Control Specification |
Stateless intervention-point policy runtime, verdicts, transform, fail-closed |
-- |
| AgentMesh Identity and Trust |
Credentials, trust scoring, delegation chains |
135 |
| Agent Hypervisor Execution Control |
Privilege rings, saga orchestration, kill switch |
80 |
| AgentMesh Trust and Coordination |
Peer trust negotiation, mesh-wide policy |
62 |
| Agent SRE Governance |
SLOs, error budgets, chaos, circuit breakers |
111 |
| MCP Security Gateway |
Tool poisoning, drift detection, hidden instructions |
127 |
| Agent Lightning Fast-Path |
RL training governance, violation penalties |
100 |
| Framework Adapter Contract |
Native framework mediation contract |
-- |
| Audit and Compliance |
Merkle audit, compliance mapping, Decision BOM |
157 |
| AgentMesh Wire Protocol |
Message format, routing, serialization |
-- |
微软推出的一个工具包，用于治理生产环境中的自主 AI 代理：它对工具调用强制执行策略、验证代理身份、对执行进行沙盒隔离，并提供终止开关、SLO 监控等 SRE 控制手段。它覆盖了 OWASP Agentic Top 10 的全部 10 项风险。