Integration Tiers: What You Get at Each Depth¶

This document explains what governance capabilities are available at each level of integration with the Agent Governance Toolkit. Not every deployment requires source code changes. Understanding the tiers helps platform teams, security architects, and agent developers decide how deeply to integrate.

Why This Matters¶

A managed agent hosting platform evaluating AGT needs to know: what security controls can be deployed as infrastructure (sidecar, proxy, config) without touching agent code? What requires the agent developer to import an SDK? What needs deep runtime hooks?

The OWASP ASI and LLM Top 10 mappings in this repo document what AGT mitigates. This document documents how you get each mitigation and what integration effort it requires.

The Three Tiers¶

Tier 0: Sidecar / Proxy / CLI (No Code Changes)¶

Deploy the governance sidecar as a container alongside your agent. The agent (or an API gateway / service mesh in front of it) calls the sidecar HTTP API before executing tool calls. No changes to agent source code are required, but the orchestration layer must route requests through the sidecar.

What you get¶

What you do NOT get¶

• No transparent interception. The sidecar does not automatically intercept tool calls. Your orchestration layer or service mesh must explicitly call the sidecar API. This is a deliberate design choice (the sidecar is a mediation layer, not a network proxy), but it means an agent that bypasses the orchestration layer bypasses governance too.
• No trust scoring or agent identity. DID-based identity, trust decay, and agent-to-agent handshake verification require SDK-level integration.
• No tamper-evident audit trail. The hash-chain audit log requires the SDK to instrument the agent's execution pipeline.
• No behavior monitoring. Anomaly detection, quarantine, and kill switch require runtime hooks.
• No output redaction. PII scrubbing of agent responses requires the SDK in the response path.

Deployment example¶

# docker-compose.yaml (simplified)
services:
  agent:
    image: your-agent:latest
    ports: ["8080:8080"]
  governance-sidecar:
    image: ghcr.io/microsoft/agentmesh/governance:latest
    ports: ["8081:8081"]
    volumes:
      - ./policy.yaml:/app/policy.yaml
    environment:
      - POLICY_PATH=/app/policy.yaml

OWASP coverage at Tier 0¶

Honest assessment: ~3/11 partial coverage. Tier 0 catches obvious prompt injection and enforces tool allowlists, but cannot enforce identity, trust, behavior monitoring, or tamper-evident auditing.

Tier 1: SDK Init (Thin Wrapper)¶

Import the AGT SDK into your agent code. Initialize the core classes and call them at the key decision points in your agent loop: before processing input, before executing tools, and after getting results.

What you add on top of Tier 0¶

Code example (Python)¶

from agent_os import PolicyEvaluator, AuditLogger
from agentmesh import TrustManager

# Initialize once
policy = PolicyEvaluator.from_yaml("policy.yaml")
audit = AuditLogger(chain=True)
trust = TrustManager()

# In your agent loop
def handle_tool_call(tool_name, params, agent_did):
    # Trust check
    score = trust.evaluate(agent_did)
    if score < policy.trust_threshold:
        audit.log("deny", tool=tool_name, reason="trust_below_threshold")
        return deny()

    # Policy check
    decision = policy.evaluate(tool_name, params)
    if not decision.allowed:
        audit.log("deny", tool=tool_name, reason=decision.reason)
        return deny()

    # Execute and audit
    result = execute_tool(tool_name, params)
    audit.log("allow", tool=tool_name, result_hash=hash(result))
    return result

OWASP coverage at Tier 1¶

Honest assessment: ~6/11 full coverage. The SDK integration closes the identity, trust, and audit gaps that Tier 0 cannot reach.

Tier 2: Deep Integration (Full Runtime)¶

Wire AGT into your agent framework's middleware pipeline. This gives you the complete governance surface including behavior monitoring, execution rings, memory guards, and framework-specific adapters.

What you add on top of Tier 1¶

OWASP coverage at Tier 2¶

Honest assessment: ~8/11 full coverage, 3/11 partial. The remaining gaps (supply chain SBOM depth, memory sandboxing, UI-level human guardrails) are documented in the OWASP mapping.

Decision Guide¶

Relationship to OWASP Mappings¶

The detailed OWASP mappings in this repo document mitigation mechanisms and code evidence:

• OWASP ASI 2026 mapping (11 agentic risks)
• OWASP LLM Top 10 mapping (10 LLM risks)
• MCP OWASP mapping (MCP-specific risks)

Those documents describe what AGT mitigates. This document describes how much integration effort each mitigation requires. Read them together.

Known Limitations¶

1. Transparent interception is not implemented. The sidecar requires explicit API calls from the orchestration layer. A service mesh integration (Istio, Envoy) that intercepts tool-call traffic transparently is on the roadmap but not shipped.

2. Detection without enforcement. Several detection modules (PromptInjectionDetector, TokenBudgetTracker, RateLimiter, ScopeGuard, SupplyChainGuard) exist as standalone utilities but are not auto-wired into the BaseIntegration lifecycle. They require explicit SDK integration to enforce. See the LLM Top 10 mapping for details.

3. Framework adapter coverage varies. The MAF/Semantic Kernel adapter has the deepest enforcement wiring. Other framework adapters may require manual wiring for some Tier 2 capabilities.