Agent Governance Toolkit

// Overview

The Agent Governance Toolkit — AGT — answers three questions about a deployed agent: whether an action is allowed, which agent took it, and whether you can prove afterwards what happened. Its argument is that prompt-level safety is not a control surface, so every tool call, message send and delegation is intercepted in deterministic application code before the model's intent reaches the wire. Actions the kernel denies are structurally impossible rather than merely unlikely.

The smallest useful form is two lines: wrap a tool function with `govern()` and point it at a YAML policy. On every call the wrapper evaluates the policy, writes the decision to an audit trail, and raises `GovernanceDenied` when a rule blocks the action. Rules are conditions over the action, with `allow`, `deny` and `require_approval` effects and named approvers. From there the layers are optional and additive — the project notes that most teams run policy enforcement plus audit logging and never need the rest.

The full Python stack is split into consolidated distributions covering the policy engine and capability model, a runtime with four privilege rings, an SRE layer with kill switch, SLOs and chaos testing, and an `agt` CLI for OWASP verification, policy linting and prompt-injection scanning. TypeScript, .NET, Rust and Go SDKs implement the core governance surface — policy, identity, trust and audit — and there are first-party plugin surfaces for Claude Code, Copilot CLI and OpenCode. The README labels the project a public preview that may take breaking changes before GA.

// What it does

• Deterministic interception of tool calls, message sends and delegations before they leave the process, with allow / deny / require-approval effects
• YAML policy files, plus OPA and Cedar, evaluated by a stateless fail-closed policy runtime with a Rust core
• Zero-trust agent identity over SPIFFE, DID and mTLS, so a decision record names which agent acted
• Tamper-evident audit trail producing a decision record for every evaluation
• Execution sandboxing with four privilege rings, plus an SRE layer with kill switch, SLO monitoring and chaos testing
• `agt` CLI for installation checks, OWASP compliance verification with CI-failing evidence checks, prompt-injection scanning and policy linting
• SDKs for Python, TypeScript, .NET, Rust and Go, plus plugin surfaces for Claude Code, Copilot CLI and OpenCode
• MCP security gateway covering tool poisoning, drift, typosquatting and hidden instructions, and a discovery pass that finds unregistered agents

// Getting started

AGT needs Python 3.11 or newer for the quick start. The `[full]` extra pulls in the governance modules; the base wheel installs only the compliance CLI.

pip install "agent-governance-toolkit[full]"

from agentmesh.governance import govern

safe_tool = govern(my_tool, policy="policy.yaml")

apiVersion: governance.toolkit/v1
name: production-policy
default_action: allow
rules:
  - name: block-destructive
    condition: "action.type in ['drop', 'delete', 'truncate']"
    action: deny
    description: "Destructive operations require human approval"

  - name: require-approval-for-send
    condition: "action.type == 'send_email'"
    action: require_approval
    approvers: ["security-team"]

agt doctor
agt verify
agt verify --evidence ./agt-evidence.json --strict
agt red-team scan ./prompts/ --min-grade B
agt lint-policy policies/

/plugin marketplace add microsoft/agent-governance-toolkit
/plugin install agt-governance@agent-governance-toolkit

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Reach for it when an agent with real tool access needs a rule that holds even if the prompt is compromised
• Reach for it when several agents share one API key and an incident review has to name which one acted
• Reach for it when an auditor wants a tamper-evident record of the active policy, the requested action and the verdict
• Reach for it to put an approval gate in front of a small number of high-consequence tools while everything else stays allowed

// How Agent Governance Toolkit compares

Agent Governance Toolkit alongside other open-source governance & compliance tools AI/TLDR tracks, ranked by GitHub stars.