Agent Compliance
โญ If this project helps you, please star it! It helps others discover the agent governance stack.
๐ Part of the Agent Governance Ecosystem โ Installs Agent OS ยท AgentMesh ยท Agent Runtime ยท Agent SRE
Migrating from
ai-agent-compliance? The package has been renamed toagent-governance-toolkit. Runpip install agent-governanceโ the old name is deprecated and will redirect here for 6 months.
Architecture¶
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ agent-governance โ
โ pip install agent-governance-toolkit[full] โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค
โ โ
โ โโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โ
โ โ Agent OS Kernel โโโโโโโบโ AgentMesh Platform โ โ
โ โ โ โ โ โ
โ โ Policy Engine โ โ Zero-Trust Identity โ โ
โ โ Capability Model โ โ Mutual TLS for Agents โ โ
โ โ Audit Logging โ โ Encrypted Channels โ โ
โ โ Syscall Layer โ โ Trust Scoring โ โ
โ โโโโโโโโโโฌโโโโโโโโโโโ โโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโ โ
โ โ โ โ
โ โผ โผ โ
โ โโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โ
โ โ Agent Runtime โ โ Agent SRE โ โ
โ โ โ โ โ โ
โ โ Execution Rings โ โ Health Monitoring โ โ
โ โ Resource Limits โ โ SLO Enforcement โ โ
โ โ Runtime Sandboxingโ โ Incident Response โ โ
โ โ Kill Switch โ โ Chaos Engineering โ โ
โ โโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โ
โ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Quick Start¶
import asyncio
from agent_os import StatelessKernel, ExecutionContext
from agentmesh import AgentIdentity
# Boot the governance kernel
kernel = StatelessKernel()
ctx = ExecutionContext(agent_id="my-agent", policies=["read_only"])
# Establish zero-trust agent identity
identity = AgentIdentity.create(
name="my-agent",
sponsor="alice@company.com",
capabilities=["read:data", "write:reports"],
)
# Execute a governed action
async def main():
result = await kernel.execute(
action="database_query",
params={"query": "SELECT * FROM users"},
context=ctx,
)
print(f"Success: {result.success}, Data: {result.data}")
asyncio.run(main())
Compliance Grading¶
Check your governance coverage with a compliance grade:
from agent_compliance.verify import GovernanceVerifier
verifier = GovernanceVerifier()
attestation = verifier.verify()
print(f"Grade: {attestation.compliance_grade()}") # A, B, C, D, or F
print(f"Coverage: {attestation.coverage_pct()}%")
print(attestation.badge_markdown())
Install only what you need:
# Core: kernel + trust mesh
pip install agent-governance-toolkit
# Full stack: adds runtime + SRE
pip install agent-governance-toolkit[full]
# ร la carte
pip install agent-governance-toolkit[runtime]
pip install agent-governance-toolkit[sre]
Components¶
| Package | Role |
|---|---|
| Agent OS | Policy engine โ deterministic action evaluation |
| AgentMesh | Trust infrastructure โ identity, credentials, protocol bridges |
| Agent Runtime | Execution supervisor โ rings, sessions, sagas |
| Agent SRE | Reliability โ SLOs, circuit breakers, chaos testing |
| Agent Compliance | Regulatory compliance โ GDPR, HIPAA, SOX frameworks (this package) |
| Agent Marketplace | Plugin lifecycle โ discover, install, verify, sign |
| Agent Lightning | RL training governance โ governed runners, policy rewards |
Star the ecosystem¶
[](https://github.com/microsoft/agent-governance-toolkit) [](https://github.com/microsoft/agent-governance-toolkit) [](https://github.com/microsoft/agent-governance-toolkit) [](https://github.com/microsoft/agent-governance-toolkit)
Why a Unified Governance Stack?¶
Running AI agents in production without governance is like deploying microservices without TLS, RBAC, or monitoring. Each layer solves a different problem:
| Concern | Without Governance | With Agent Governance |
|---|---|---|
| Security | Agents call any tool, access any resource | Capability-based permissions, policy enforcement |
| Trust | No identity verification between agents | Mutual TLS, trust scores, encrypted channels |
| Control | Runaway agents consume unbounded resources | Execution rings, resource limits, kill switches |
| Reliability | Silent failures, no observability | SLO enforcement, health checks, incident automation |
| Compliance | No audit trail for agent decisions | Immutable audit logs, decision lineage tracking |
One install. Four layers of protection.
The meta-package ensures all components are version-compatible and properly integrated. No dependency conflicts, no version mismatches โ just a single pip install to go from zero to production-grade agent governance.
The Agent Governance Ecosystem¶
agent-governance โโโ The meta-package (you are here)
โโโ agent-os-kernel โโโ Governance kernel
โโโ agentmesh-platform โโโ Zero-trust mesh
โโโ agentmesh-runtime โโโ Runtime supervisor (optional)
โโโ agent-sre โโโ Reliability engineering (optional)
Each component works standalone, but they're designed to work together. The kernel enforces policy, the mesh secures communication, the runtime controls execution, and SRE keeps everything running.
Examples¶
See the examples/ directory for runnable demos:
# Quick start โ boot the governance stack in 30 lines
python examples/quickstart.py
# Full stack โ all 4 layers working together
python examples/governed_agent.py
Framework Integration¶
# LangChain
pip install langchain agent-governance
# CrewAI
pip install crewai agent-governance
# AutoGen
pip install pyautogen agent-governance
๐บ๏ธ Roadmap¶
| Quarter | Milestone |
|---|---|
| Q1 2026 | โ Unified meta-package, 4 components integrated, PyPI published |
| Q2 2026 | Cross-component integration tests, unified CLI, dashboard UI |
| Q3 2026 | Helm chart for Kubernetes, managed cloud preview |
| Q4 2026 | SOC2 Type II certification, enterprise support tier |
๐ก๏ธ OWASP Agentic Top 10 Coverage¶
The agent governance stack covers 10 of 10 risks from the OWASP Top 10 for Agentic Applications (2026):
| OWASP Risk | Coverage | Component |
|---|---|---|
| Agent Goal Hijack | โ | Agent OS โ Policy Engine |
| Tool Misuse | โ | Agent OS โ Capability Sandboxing |
| Identity & Privilege Abuse | โ | AgentMesh โ DID Identity |
| Supply Chain Vulnerabilities | โ | AgentMesh โ AI-BOM v2.0 |
| Unexpected Code Execution | โ | Agent Runtime โ Execution Rings |
| Memory & Context Poisoning | โ | Agent OS โ VFS + CMVK |
| Insecure Inter-Agent Communication | โ | AgentMesh โ IATP Protocol |
| Cascading Failures | โ | Agent SRE โ Circuit Breakers |
| Human-Agent Trust Exploitation | โ | Agent OS โ Approval Workflows |
| Rogue Agents | โ | Agent Runtime โ Kill Switch |
โ Full OWASP compliance mapping with code examples
๐ Traction¶
The ecosystem is growing โ 3,000+ views, 9,400+ clones, and 1,278 unique developers in the last 14 days alone. Traffic from Medium, Reddit, LinkedIn, Google, and even ChatGPT.
Contributing¶
We welcome contributions! See our Contributing Guide for details.
For component-specific contributions, see: - Agent OS - AgentMesh - Agent Runtime - Agent SRE
License¶
MIT โ see LICENSE for details.