$ show microsoft/agent-governance-toolkit
This repository is Microsoft's Agent Governance Toolkit, a production-grade multi-language framework (Python, TypeScript, Rust, Go, .NET) for enforcing policy, identity, trust, audit, and sandboxing on autonomous AI agents. In production, it intercepts agent tool calls, messages, and delegations before they reach external services, evaluating them against declarative policies (OPA, Cedar, or custom backends) with deterministic outcomes (allow/deny/escalate/transform). The system provides a full governance plane including a Rust-based policy engine (Agent Control Specification), a service mesh (AgentMesh) with API gateway, trust engine, policy server, and audit collector, a hypervisor for execution rings and sandboxing (Docker, Hyperlight, Nono), compliance verification (OWASP, EU AI Act), SLO monitoring, and a plugin marketplace. Integrations exist for LangChain, CrewAI, AutoGen, OpenAI Agents, Semantic Kernel, MCP, and many other frameworks. The toolkit is deployed as CLI tools (`agt`, `agentmesh`, `agentos`), Docker containers with sidecar patterns, Kubernetes charts, and VS Code/Chrome extensions. The architecture is polyglot with a shared policy engine core written in Rust; the Python SDK is the richest, with the .NET and Go SDKs covering governance middleware and lifecycle management. The codebase is heavily tested with 992 conformance tests across 10 formal specs, fuzzing targets, and CI gates enforcing deterministic policy outcomes, fail-closed behavior, and no-stub registration.
The LLM identified 5 files worth highlighting for reuse:
Implements a Merkle-style hash-chain delta audit engine that records incremental state changes linked via SHA-256 hashes of the previous entry. The chain is tamper-evident and supports offline verification. The pattern is self-contained with no internal imports beyond standard library and a simple model, making it extractable into any system requiring append-only, integrity-checked audit logs.
Defines a cryptographic digest scheme for binding approval requests to specific agent actions using JSON Canonicalization Scheme (JCS) and SHA-256 hashing. This one-time-use digest prevents replay attacks and ensures approvals cannot be re-bound to different actions. The module is a standalone utility with no dependency on the rest of the governance stack, making it reusable in any system requiring auditable, non-repudiable approval workflows.
Implements four policy conflict resolution strategies (DenyOverrides, AllowOverrides, PriorityFirstMatch, MostSpecificWins) as a clean strategy pattern. Each strategy is a separate class with a common interface, allowing composable policy evaluation. The implementation is generic and could be extracted to any authorization or rule engine requiring deterministic conflict resolution. Demonstrates non-obvious skill in handling policy priorities and specificity without external dependencies.
Implements breach detection across execution rings (Ring0–Ring3) using configurable thresholds for resource access and system calls. Maintains per-ring permission sets and detects transitions that violate ring boundaries. The pattern is a clean implementation of multi-level privilege separation for agent processes, reusable in any security-critical sandboxed environment. Decoupled from the specific sandbox provider, it can be adapted to different ring taxonomies.
Python implementation of the same conflict resolution strategies seen in the .NET version, but as a module-level API with a ResolutionStrategy protocol. Supports DenyOverrides, AllowOverrides, PriorityFirstMatch, and MostSpecificWins. The module is self-contained with only stdlib typing imports and a few internal models, demonstrating a clean reusable pattern for combining multiple policy decisions into a single outcome.