Runtime Governance Framework for Autonomous Agents
The Agent Governance Toolkit (AGT) is a runtime governance framework designed to enforce deterministic policy controls on autonomous agents. It addresses critical security challenges by intercepting and validating every tool call, message, or delegation before execution, eliminating probabilistic defenses like prompt-level safety. This approach ensures that unauthorized actions are structurally impossible, not merely discouraged.
AGT is built on the principle that traditional prompt-level safety mechanisms are insufficient. Research, including studies by Andriushchenko et al. Microsoft’s AI Red Teaming Agent formalizes the Attack Success Rate (ASR) as a metric for policy violations, reinforcing the need for deterministic enforcement. The OWASP LLM01:2025 standard explicitly states that prompt injection mitigations are not foolproof, further validating AGT’s deterministic approach.
The toolkit is structured around three core questions: (1) Is this action allowed? (2) Which agent performed it? (3) Can the action be proven? AGT answers these by enforcing policies at the application layer, logging decisions tamper-evidently, and verifying agent identities through zero-trust mechanisms. Unlike OAuth scopes or IAM roles, which control service access rather than action granularity, AGT evaluates each tool call against predefined rules, such as blocking destructive operations like drop, delete, or truncate without human approval.
The core workflow involves an agent making a request, which is evaluated by a policy engine (supporting YAML, OPA, or Cedar), verified against agent identity (using SPIFFE, DID, or mTLS), and logged for audit purposes. If the policy allows the action, the tool executes; if denied, a GovernanceDenied exception is raised. This design ensures fail-closed operations, where actions are blocked by default unless explicitly permitted.
How It Works
AGT operates through a layered architecture where each component is optional, enabling gradual adoption based on risk profiles. The primary layers include the Policy Engine, Identity Verification, and Audit Logging. The Policy Engine evaluates requests against configurable rules defined in YAML, OPA, or Cedar. For example, a policy might require approval for email sends or block destructive database operations. The Identity layer ensures that actions are attributed to specific agents, even in multi-agent systems sharing API keys, by using standards like SPIFFE or decentralized identifiers (DID). The Audit Log captures tamper-evident records of every decision, including the policy applied, the agent’s request, and the enforcement outcome.
The Agent Control Specification (ACS) is the canonical policy decision runtime for AGT. Hosts send complete snapshots of agent actions to ACS, which returns one of five verdicts: allow, warn, deny, escalate, or transform. This fail-closed approach ensures that frameworks, gateways, and custom hosts can enforce consistent policies without retaining hidden state. ACS supports intervention at multiple points, such as tool invocation, message sending, or delegation, making it adaptable to diverse agent architectures.
AGT integrates with major agent frameworks, including LangChain, CrewAI, OpenAI Agents, LangGraph, LlamaIndex, and Google ADK. For example, wrapping a tool function with govern() from agentmesh.governance enforces policy checks on every call.
Policy Enforcement and Deterministic Controls
AGT’s policy engine evaluates tool calls in real-time, ensuring that only permitted actions proceed. Policies are defined using declarative rules, such as blocking drop table operations or requiring approval for email sends. This deterministic enforcement contrasts with probabilistic defenses like prompt-level safety, which are vulnerable to adversarial attacks.
Zero-Trust Agent Identity
AGT enforces zero-trust principles by verifying agent identities before allowing actions. Multi-agent systems often share API keys, making incident response difficult. Identity verification is integrated into the policy evaluation process, ensuring that only authenticated agents can execute tools. This capability is critical for compliance and forensics, as it provides clear accountability in multi-agent environments.
Execution Controls and Sandboxing
The Agent Runtime component enforces these controls, ensuring that agents operate within predefined boundaries.
Audit Trails and Compliance
Every decision made by AGT is logged tamper-evidently, creating an immutable record of policy evaluations, agent requests, and enforcement outcomes. This audit trail supports compliance with regulatory requirements and facilitates incident investigations. For example, a scan might identify adaptive attacks targeting GPT-4o or Claude 3, as documented in the JailbreakBench benchmark. These logs are essential for demonstrating due diligence in governed environments.
Framework and Language Support
AGT supports multiple languages and frameworks, including Python, TypeScript, .NET, Rust, and Go. The Python package (agent-governance-toolkit[full]) consolidates 45 individual packages into five distributions, simplifying integration. Framework adapters are available for LangChain, CrewAI, and OpenAI Agents, ensuring broad compatibility. The toolkit also includes CLI tools for policy linting, compliance checks, and red-team scanning, making it adaptable to diverse workflows.
OWASP and Compliance Tools
AGT aligns with the OWASP Top 10 for Agentic Applications, providing tools to verify compliance and mitigate risks. For example, the acs-email-tool example demonstrates how ACS evaluates tool calls against portable policy manifests, ensuring interoperability across frameworks. These compliance features are critical for enterprises deploying agents in regulated industries.
Production Deployment of Autonomous Agents
AGT is designed for shipping autonomous agents to production without compromising security. By intercepting every tool call, message, or delegation, AGT ensures that agents adhere to predefined policies, even in dynamic environments. For example, a financial agent querying databases must comply with rules blocking destructive operations, while a customer support agent may require approval for sensitive email sends. This deterministic enforcement reduces the risk of policy violations, as demonstrated by Microsoft’s AI Red Teaming Agent, which measures Attack Success Rate (ASR) under adversarial conditions.
Multi-Agent Systems with Shared Credentials
In multi-agent systems where multiple agents share API keys or credentials, AGT provides zero-trust identity verification. This ensures that actions are attributed to specific agents, improving incident response and accountability. This capability is essential for auditing and compliance in environments with shared access patterns.
Regulated Environments with Audit Requirements
AGT’s tamper-evident audit logs meet regulatory requirements for proving agent actions. Auditors and regulators need evidence of policy enforcement, including which rules were active, what requests were made, and why they were allowed or denied. For example, a healthcare agent querying patient records must log every access attempt, even if denied, to demonstrate compliance with data protection laws. AGT’s audit trails support these requirements by capturing immutable records of all governance decisions.
Framework-Agnostic Governance
AGT integrates with major agent frameworks, including LangChain, CrewAI, and OpenAI Agents, making it suitable for heterogeneous environments. For example, a LangChain-based agent can use govern() to wrap tool calls, while a CrewAI multi-agent system can enforce role-based policies. The toolkit’s framework adapters and portable policy contracts (via ACS) enable this interoperability.
Continuous Red Teaming and Risk Mitigation
This aligns with Microsoft’s findings that mitigations do not eliminate risk entirely and that red teaming must be an ongoing process.
Sandboxed Execution and Privilege Control
The Agent Runtime component enforces these controls, while the Agent Hypervisor tracks execution deltas and enforces command denylists, ensuring that agents operate within safe boundaries.