Ockam is a framework for building secure, interconnected systems that provides identity-based end-to-end encrypted communication, secure channel establishment, and policy-based access control. The architecture features clear separation of concerns with modules for core types, identity management, secure channels, transport abstractions, vault cryptography, API orchestration, and a command-line interface. Implemented primarily in Rust with Elixir components, it uses async/await and OTP patterns for concurrency. Key entry points include the ockam CLI, node builder/context, and orchestrator API. The system enables secure multi-hop routing, message forwarding, and service integration with external systems like Kafka and InfluxDB.
This repository is Microsoft's Agent Governance Toolkit, a production-grade multi-language framework (Python, TypeScript, Rust, Go, .NET) for enforcing policy, identity, trust, audit, and sandboxing on autonomous AI agents. In production, it intercepts agent tool calls, messages, and delegations before they reach external services, evaluating them against declarative policies (OPA, Cedar, or custom backends) with deterministic outcomes (allow/deny/escalate/transform). The system provides a full governance plane including a Rust-based policy engine (Agent Control Specification), a service mesh (AgentMesh) with API gateway, trust engine, policy server, and audit collector, a hypervisor for execution rings and sandboxing (Docker, Hyperlight, Nono), compliance verification (OWASP, EU AI Act), SLO monitoring, and a plugin marketplace. Integrations exist for LangChain, CrewAI, AutoGen, OpenAI Agents, Semantic Kernel, MCP, and many other frameworks. The toolkit is deployed as CLI tools (`agt`, `agentmesh`, `agentos`), Docker containers with sidecar patterns, Kubernetes charts, and VS Code/Chrome extensions. The architecture is polyglot with a shared policy engine core written in Rust; the Python SDK is the richest, with the .NET and Go SDKs covering governance middleware and lifecycle management. The codebase is heavily tested with 992 conformance tests across 10 formal specs, fuzzing targets, and CI gates enforcing deterministic policy outcomes, fail-closed behavior, and no-stub registration.