microsoft/agent-governance-toolkit

What it solves

AI agents often make autonomous decisions that can lead to security risks, such as executing destructive database commands or sending unauthorized emails. Traditional prompt-level safety (asking the agent to follow rules) is probabilistic and can be bypassed via prompt injection. This toolkit provides a deterministic governance layer that intercepts tool calls and actions before they are executed, making unauthorized actions structurally impossible rather than just unlikely.

How it works

The toolkit acts as a gatekeeper between the AI agent and the tools it uses. It uses a policy engine (supporting YAML, OPA, or Cedar) to evaluate every request against a set of defined rules. The process follows a linear flow: Agent $\rightarrow$ Policy Engine $\rightarrow$ Identity $\rightarrow$ Audit Log. If a rule blocks an action, the system raises a GovernanceDenied error; if it requires approval, it triggers a human-in-the-loop workflow. It also includes identity management (SPIFFE/DID/mTLS) and tamper-evident audit logs for regulatory compliance.

Who it’s for

Developers and SREs deploying autonomous AI agents to production environments who need strict control, auditability, and security guarantees that cannot be bypassed by the LLM itself.

Highlights

• Multi-Language Support: SDKs available for Python, TypeScript, .NET, Rust, and Go.
• Framework Agnostic: Integrates with major frameworks like AutoGen, LangGraph, CrewAI, Semantic Kernel, and OpenAI Agents SDK.
• Deterministic Enforcement: Moves safety from the prompt layer to the application code layer to prevent prompt injection attacks.
• Comprehensive Tooling: Includes a CLI for OWASP compliance checks, policy linting, and prompt injection auditing.
• Advanced Governance: Features privilege rings for sandboxing, SLO monitoring, and a "kill switch" for agent fleets.
• MCP Security Gateway: Specifically detects tool poisoning, drift, and hidden instructions in Model Context Protocol (MCP) servers.