Modern Agent Architecture & the Agent Governance Toolkit (AGT)¶

Audience: Technical decision-makers evaluating governance for enterprise AI agent deployments

Repo: microsoft/agent-governance-toolkit — MIT Licensed, Public Preview

The Problem: AI Agents Are Powerful… and Ungoverned¶

Enterprise AI is shifting from chat-based copilots to autonomous agents — systems that reason, plan, use tools, and coordinate with other agents. This creates a governance gap:

Current frameworks (LangChain, CrewAI, AutoGen) rely on prompt-based safety — asking the LLM to follow rules. That's like asking a driver to self-enforce the speed limit.

Benchmark result: Prompt-based safety has a 26.67% policy violation rate. AGT's deterministic application-layer enforcement: 0.00%.

Architecture Overview: The Governance Stack¶

AGT provides runtime governance infrastructure — it sits between your agent framework and the actions agents take. It governs what agents do, not what they say.

╔══════════════════════════════════════════════════════════════════════╗
║                    AGENT GOVERNANCE TOOLKIT                         ║
║              pip install agent-governance-toolkit[full]              ║
║                                                                     ║
║   Agent Action ───► POLICY CHECK ───► Allow / Deny    (< 0.1 ms)   ║
║                                                                     ║
║   ┌──────────────────────────┐     ┌───────────────────────────┐    ║
║   │      AGENT OS ENGINE     │◄───►│        AGENTMESH          │    ║
║   │                          │     │                           │    ║
║   │  ● Policy Engine         │     │  ● Zero-Trust Identity    │    ║
║   │  ● Capability Model      │     │  ● Ed25519 / SPIFFE Certs │    ║
║   │  ● Audit Logging         │     │  ● Trust Scoring (0-1000) │    ║
║   │  ● Action Interception   │     │  ● A2A + MCP Bridge       │    ║
║   └────────────┬─────────────┘     └──────────────┬────────────┘    ║
║                │                                  │                 ║
║                ▼                                  ▼                 ║
║   ┌──────────────────────────┐     ┌───────────────────────────┐    ║
║   │     AGENT RUNTIME        │     │        AGENT SRE          │    ║
║   │                          │     │                           │    ║
║   │  ● 4-Tier Privilege Rings│     │  ● SLOs + Error Budgets   │    ║
║   │  ● Resource Limits       │     │  ● Replay & Chaos Testing │    ║
║   │  ● Saga Orchestration    │     │  ● Circuit Breakers       │    ║
║   │  ● Kill Switch           │     │  ● Progressive Delivery   │    ║
║   └──────────────────────────┘     └───────────────────────────┘    ║
║                                                                     ║
║   ┌──────────────────────────┐     ┌───────────────────────────┐    ║
║   │   AGENT MARKETPLACE      │     │     AGENT LIGHTNING       │    ║
║   │                          │     │                           │    ║
║   │  ● Plugin Discovery      │     │  ● RL Training Governance │    ║
║   │  ● Signing & Verification│     │  ● Policy Rewards         │    ║
║   └──────────────────────────┘     └───────────────────────────┘    ║
╚══════════════════════════════════════════════════════════════════════╝

How It Works: The Operating-System Analogy¶

Think of AGT as an operating-system-inspired governance layer for AI agents:

Key insight: Current frameworks ask LLMs to decide whether to follow rules. AGT inverts this: the policy layer decides, the LLM computes.

Scope note: This is an architectural analogy, not a claim of OS-level isolation. AGT enforces policy at the application layer and composes with container or VM isolation for stronger runtime boundaries.

Core Capabilities¶

1. Deterministic Policy Enforcement (Agent OS)¶

Define exactly what each agent can and cannot do — enforced at the application layer, not by prompts:

from agent_control_specification import AgentControl, HostSession

runtime = AgentControl.from_path("policies/manifest.yaml")
session = HostSession(
    runtime,
    agent_id="architecture-agent",
    session_id="architecture-session",
)

result = session.pre_tool_call(
    tool_name="delete_file",
    args={"path": "/etc/passwd"},
)
# result.verdict.decision.permits is False

Supports OPA/Rego and Cedar policies so you can reuse existing infrastructure policies.

2. Zero-Trust Agent Identity (AgentMesh)¶

Every agent gets cryptographic identity with trust scoring:

from agentmesh import MeshNode

node = MeshNode(agent_id="supply-chain-optimizer")
# Agent receives Ed25519 credentials + trust score (0-1000)
# Score changes based on: policy compliance, task success, anomalies

3. Execution Sandboxing (Agent Runtime)¶

4-tier privilege rings inspired by OS hardware rings:

• Ring 0 (Admin): Full tool access — for trusted orchestrators
• Ring 1 (Standard): Scoped tool access — most production agents
• Ring 2 (Restricted): Read-only + approved writes — new/untested agents
• Ring 3 (Sandboxed): No external access — training and testing

Includes saga orchestration for multi-step workflows: if step 4 fails, compensating actions undo steps 1–3 automatically.

4. Agent SRE (Reliability Engineering)¶

Apply SRE practices to your agent fleet:

• SLOs & Error Budgets: "99.5% of agent actions must comply with policy"
• Chaos Engineering: Inject failures to test agent resilience
• Circuit Breakers: Automatically stop agents that exceed error thresholds
• Replay Debugging: Deterministically replay agent sessions for root-cause analysis

5. MCP Security Scanner¶

Detect attacks on MCP (Model Context Protocol) tool definitions:

mcp-scan scan mcp-config.json --server my-mcp-server

Use --static-only for untrusted configs. Live scans may launch stdio commands or connect to configured Streamable HTTP/SSE endpoints.

Catches: tool poisoning, typosquatting, hidden instructions, rug-pull attacks.

OWASP Agentic Top 10 Coverage (10/10)¶

Regulatory Alignment¶

Quick Start: 10 Minutes to Governed Agents¶

Step 1: Install¶

pip install agent-governance-toolkit[full]

Also available for: TypeScript (npm install @microsoft/agent-governance-sdk), .NET (dotnet add package Microsoft.AgentGovernance), Rust (cargo add agentmesh), Go

Step 2: Your First Governed Agent¶

from agent_control_specification import AgentControl, HostSession

runtime = AgentControl.from_path("policies/manifest.yaml")
session = HostSession(
    runtime,
    agent_id="langchain-agent-1",
    session_id="session-1",
)

# Allowed
result = session.pre_tool_call(
    tool_name="web_search",
    args={"query": "quarterly sales data"},
)
print(f"Allowed: {result.verdict.decision.permits}")

# Blocked deterministically
result = session.pre_tool_call(
    tool_name="delete_file",
    args={"path": "/critical/data.csv"},
)
print(f"Allowed: {result.verdict.decision.permits}")

Step 3: Wrap an Existing Framework¶

from agent_control_specification import AgentControl
from agent_os.integrations.langchain_adapter import LangChainKernel

runtime = AgentControl.from_path("policies/manifest.yaml")
kernel = LangChainKernel(runtime=runtime)

For deeper integration, use framework-specific adapters:

pip install agentmesh-langchain      # LangChain
pip install llamaindex-agentmesh     # LlamaIndex
pip install crewai-agentmesh         # CrewAI

Step 4: Verify OWASP Coverage¶

agt verify         # Text summary
agt verify --json  # JSON for CI/CD
agt verify --badge # Badge for your README

Framework Compatibility¶

Works with 20+ agent frameworks — no vendor lock-in:

Enterprise Use Cases¶

Manufacturing & Supply Chain (e.g., CPG)¶

• Multi-agent supply chain optimization with deterministic safety guardrails
• Quality control agents governed by compliance policies (ISO, HACCP)
• Demand forecasting agents with audit trails for regulatory review
• Cross-supplier agent coordination via zero-trust identity and trust scoring

Financial Services¶

• SOC2-compliant trading and analysis agents
• Policy enforcement for PII/PCI data handling
• Multi-agent fraud detection with circuit breakers

Healthcare¶

• HIPAA-compliant medical data agents
• Automatic PHI protection via blocked patterns
• Multi-agent diagnostic workflows with full audit trails

Deployment Options¶

Resources¶

Agent Governance Toolkit is a Microsoft open-source project (MIT License). Public Preview -- production-quality with 13,000+ tests.