Microsoft's answer to 'an agent did it' is structural impossibility

What it does

The Agent Governance Toolkit wraps autonomous AI agents in policy enforcement, identity verification, execution sandboxing, and tamper-evident audit logging. A single govern() call wraps any tool function with YAML-driven rules that evaluate before the model’s intent reaches the wire. Denied actions raise GovernanceDenied — not because the model was asked nicely, but because the code makes them structurally impossible.

The interesting bit

The README is refreshingly blunt about why this matters: prompt-level safety is “a polite request to a stochastic system,” and published research shows 100% attack success rates against major models using adaptive techniques. Rather than fighting that unwinnable battle, AGT intercepts at the application layer. It also maps directly to all ten items in the OWASP Agentic Top 10 — a compliance checklist that most agent frameworks ignore entirely.

Key highlights

• Multi-language support: Python, TypeScript, .NET, Rust, and Go SDKs with matching package managers (PyPI, npm, NuGet)
• Modular architecture: Policy Engine, Agent Mesh (discovery/routing), Runtime sandboxing with four privilege rings, SRE tooling with kill switches and chaos testing
• MCP Security Gateway for tool poisoning detection and hidden-instruction scanning
• Shadow AI Discovery to find unregistered agents lurking in processes and configs
• CLI toolkit including agt verify for OWASP compliance checks and agt red-team scan for prompt injection audits
• Public Preview status with Microsoft-signed releases; breaking changes possible before GA

Caveats

• Still in Public Preview; the README explicitly warns of potential breaking changes before general availability
• The full stack (SPIFFE/DID identity, tamper-evident anchoring) is likely overkill for simple single-agent deployments; most teams stick to policy + audit logging
• Some packages like Agent Lightning (RL training governance) and Agent Hypervisor (delta engine, commitment anchoring) are described but not deeply documented in the README

Verdict

Teams shipping multi-agent systems to production with actual compliance requirements should evaluate this seriously. Solo developers building weekend prototypes will find the surface area excessive — start with the basic govern() wrapper and expand only when auditors or incident response actually demand it.