# Agent Governance Toolkit

> Policy enforcement, agent identity, sandboxing and SRE for autonomous agents

- Category: Evaluation & Production Ops / Governance & Compliance
- Language: Python
- Licence: MIT
- Repository: https://github.com/microsoft/agent-governance-toolkit
- Website: https://microsoft.github.io/agent-governance-toolkit/
- Canonical page: https://ai-tldr.dev/tools/agent-governance-toolkit/
- Updated: 2026-04-02

## In short

Agent Governance Toolkit is Policy enforcement, agent identity, sandboxing and SRE for autonomous agents. It sits in the Governance & Compliance category of the Evaluation & Production Ops tools and is open-source, written in Python and licensed MIT. To get started: install.

## Overview

The Agent Governance Toolkit — AGT — answers three questions about a deployed agent: whether an action is allowed, which agent took it, and whether you can prove afterwards what happened. Its argument is that prompt-level safety is not a control surface, so every tool call, message send and delegation is intercepted in deterministic application code before the model's intent reaches the wire. Actions the kernel denies are structurally impossible rather than merely unlikely.

The smallest useful form is two lines: wrap a tool function with `govern()` and point it at a YAML policy. On every call the wrapper evaluates the policy, writes the decision to an audit trail, and raises `GovernanceDenied` when a rule blocks the action. Rules are conditions over the action, with `allow`, `deny` and `require_approval` effects and named approvers. From there the layers are optional and additive — the project notes that most teams run policy enforcement plus audit logging and never need the rest.

The full Python stack is split into consolidated distributions covering the policy engine and capability model, a runtime with four privilege rings, an SRE layer with kill switch, SLOs and chaos testing, and an `agt` CLI for OWASP verification, policy linting and prompt-injection scanning. TypeScript, .NET, Rust and Go SDKs implement the core governance surface — policy, identity, trust and audit — and there are first-party plugin surfaces for Claude Code, Copilot CLI and OpenCode. The README labels the project a public preview that may take breaking changes before GA.

## What it does

- Deterministic interception of tool calls, message sends and delegations before they leave the process, with allow / deny / require-approval effects
- YAML policy files, plus OPA and Cedar, evaluated by a stateless fail-closed policy runtime with a Rust core
- Zero-trust agent identity over SPIFFE, DID and mTLS, so a decision record names which agent acted
- Tamper-evident audit trail producing a decision record for every evaluation
- Execution sandboxing with four privilege rings, plus an SRE layer with kill switch, SLO monitoring and chaos testing
- `agt` CLI for installation checks, OWASP compliance verification with CI-failing evidence checks, prompt-injection scanning and policy linting
- SDKs for Python, TypeScript, .NET, Rust and Go, plus plugin surfaces for Claude Code, Copilot CLI and OpenCode
- MCP security gateway covering tool poisoning, drift, typosquatting and hidden instructions, and a discovery pass that finds unregistered agents

## Getting started

AGT needs Python 3.11 or newer for the quick start. The `[full]` extra pulls in the governance modules; the base wheel installs only the compliance CLI.

1. Install

   Install the meta-package with the full extra.

```bash
pip install "agent-governance-toolkit[full]"
```

2. Govern a tool in two lines

   Wrap any callable and give it a policy file. Every call is then checked, logged and enforced.

```python
from agentmesh.governance import govern

safe_tool = govern(my_tool, policy="policy.yaml")
```

3. Write the policy

   Rules are conditions over the action, with allow, deny or require_approval effects. A denied call raises GovernanceDenied naming the rule that blocked it.

```yaml
apiVersion: governance.toolkit/v1
name: production-policy
default_action: allow
rules:
  - name: block-destructive
    condition: "action.type in ['drop', 'delete', 'truncate']"
    action: deny
    description: "Destructive operations require human approval"

  - name: require-approval-for-send
    condition: "action.type == 'send_email'"
    action: require_approval
    approvers: ["security-team"]
```

4. Verify and audit from the CLI

   The agt CLI checks the installation, runs the OWASP compliance verification (optionally failing CI on weak evidence), audits prompts for injection, and lints policy files.

```bash
agt doctor
agt verify
agt verify --evidence ./agt-evidence.json --strict
agt red-team scan ./prompts/ --min-grade B
agt lint-policy policies/
```

5. Or install it into Claude Code

   AGT ships as a plugin marketplace for Claude Code.

```text
/plugin marketplace add microsoft/agent-governance-toolkit
/plugin install agt-governance@agent-governance-toolkit
```

## When to use it

- Reach for it when an agent with real tool access needs a rule that holds even if the prompt is compromised
- Reach for it when several agents share one API key and an incident review has to name which one acted
- Reach for it when an auditor wants a tamper-evident record of the active policy, the requested action and the verdict
- Reach for it to put an approval gate in front of a small number of high-consequence tools while everything else stays allowed

## Version history

- 2026-04-02: Covered by AI/TLDR: Microsoft open-sourced a runtime security toolkit for AI agents covering policy enforcement, zero-trust identity and execution sandboxing, released under MIT.