Microsoft's Agent Governance Toolkit: intercepting agent actions before the prompt

Microsoft released the Agent Governance Toolkit as a public preview on GitHub. The open-source library provides policy enforcement, zero-trust identity, execution sandboxing, and audit logging for autonomous AI agents. It covers all 10 items in the OWASP Agentic Top 10.

The toolkit’s central claim is that prompt-level safety is not a control surface. The README calls it “a polite request to a stochastic system.” Microsoft cites the OWASP LLM01:2025 entry on prompt injection, which states that “it is unclear if there are fool-proof methods of prevention.” It also references Andriushchenko et al. (ICLR 2025), who report a 100% attack success rate on GPT-4o, GPT-3.5, Claude 3, and Llama-3 using adaptive attacks with logprob access and suffix optimization, evaluated against the JailbreakBench benchmark.

The toolkit does not try to win that fight inside the prompt. Every tool call, message send, and delegation is intercepted in deterministic application code before the model’s intent reaches the wire. Actions the governance kernel denies are structurally impossible, not merely unlikely.

The core abstraction is a govern() wrapper. A developer decorates any tool function with a YAML policy file, and every call to that tool is checked, logged, and enforced before execution. A policy rule can block destructive operations like drop, delete, or truncate by name. It can require human approval for actions like sending email. The wrapper raises a GovernanceDenied exception when a policy violation occurs.

The policy engine supports YAML, OPA, and Cedar formats. It can be configured with a default action of allow or deny, and rules can set priority levels. The engine evaluates conditions on action type, tool name, or arbitrary fields, and returns a decision before the tool executes.

Identity is handled through SPIFFE, DID, or mTLS. In a multi-agent system where five agents might share a single API key, the toolkit assigns each agent a verifiable identity. Audit logs are tamper-evident and include the policy that was active, what the agent requested, and why it was allowed or denied.

The toolkit ships as a Python package with SDKs for TypeScript, .NET, Rust, and Go. The Python distribution is consolidated into five packages: core, runtime, SRE, CLI, and a meta-package that installs all of them. The CLI includes commands for OWASP compliance verification, prompt injection audit, and policy linting. A --strict flag on the verify command fails CI on weak evidence.

Framework support spans Microsoft Agent Framework, Semantic Kernel, AutoGen, LangGraph, LangChain, CrewAI, OpenAI Agents SDK, Claude Code, Google ADK, LlamaIndex, Haystack, Mastra, Dify, and Azure AI Foundry. The Claude Code integration is a governance plugin installed through the marketplace.

The toolkit’s architecture has four layers: policy engine, identity, audit log, and execution sandboxing. The sandbox uses four privilege rings, similar to operating system design. The runtime layer includes saga orchestration for multi-step agent workflows, termination control, execution plan validation, and a command denylist.

Additional capabilities include an MCP Security Gateway for tool poisoning detection, drift monitoring, typosquatting, and hidden instruction scanning. A Shadow AI Discovery module finds unregistered agents across processes, configs, and repos. A Governance Dashboard provides real-time fleet visibility for health, trust, and compliance.

The promptDefense Evaluator runs a 12-vector prompt injection audit. A Contributor Reputation action screens PR and issue authors for social engineering patterns.

The toolkit’s design reflects a specific bet about the future of AI agents. The bet is that agents will call many tools, browse the web, query databases, and delegate to other agents. And that those actions will need to be governed by the same kind of policy frameworks that govern human access to systems. Microsoft is building the infrastructure for that world now, before the agents are deployed at scale.

The OWASP coverage is the most concrete signal. The toolkit addresses all 10 items in the OWASP Agentic Top 10, which includes prompt injection, insecure output handling, excessive agency, and improper delegation. The verification CLI checks against these categories and produces evidence for compliance audits.

The open-source release is notable for its breadth. Microsoft is not shipping a single integration for its own agent framework. It is shipping adapters for every major agent framework on the market, including competitors’ products. The Claude Code integration is a first-party developer surface built on the TypeScript SDK. The Copilot CLI integration is also first-party.

The timing matters. Agent deployments are still early, but the pattern of failures is already visible. Agents that can call tools, browse the web, and query databases will eventually do something destructive. The question is whether the controls are in place before that happens.

Microsoft’s answer is that the controls must be in application code, not in prompts. The toolkit enforces policy at the code layer, where the behavior is deterministic. It does not ask the model to behave. It makes misbehavior structurally impossible.

The outstanding question is adoption. The toolkit is a public preview with potential breaking changes before GA. It requires a Python 3.10+ environment and optional Azure credentials for integrated features. The framework adapters are at varying levels of maturity, with some marked as adapters and others as native middleware.

Microsoft is betting that agent governance will be a platform play, not a point solution. The toolkit is designed to be the control plane for any agent, on any framework, in any language. That is a large bet. But it is grounded in a specific observation: prompt-level safety is not a control surface, and the industry needs something that is.