The Agent Governance Toolkit is a Microsoft-maintained Python framework designed to enforce policy, identity, and execution controls on autonomous AI agents before they reach production. The repository addresses a critical gap in AI agent safety: while prompt-level safety measures are probabilistic and can be circumvented through adversarial attacks, the toolkit implements deterministic application-layer controls that make policy violations structurally impossible rather than merely unlikely. Every tool call, message send, and agent delegation is intercepted in code before execution, ensuring that actions denied by the governance kernel cannot occur at all.
The toolkit's core purpose is answering three operational questions for deployed agents: whether a requested action is permitted under active policy, which specific agent performed an action in multi-agent systems, and whether complete tamper-evident audit records exist for regulatory and incident response purposes. The repository explicitly grounds its approach in OWASP LLM01:2025 guidance on prompt injection and cites research showing 100 percent attack success rates against major models when using adaptive attacks, making model-layer defenses insufficient as a sole control mechanism.
The architecture is modular and layered, allowing teams to adopt components incrementally. The Agent OS package provides the policy engine and governance gate. The Agent Control Specification implements a stateless, deterministic, fail-closed policy decision runtime with a Rust core. Additional packages handle agent discovery and routing through Agent Mesh, execution sandboxing with privilege rings via Agent Runtime, reliability engineering through Agent SRE, compliance verification and policy linting via Agent Compliance, plugin governance through Agent Marketplace, reinforcement learning governance via Agent Lightning, and execution audit and command enforcement through Agent Hypervisor. Specialized capabilities include an MCP Security Gateway for tool poisoning detection and drift monitoring, Shadow AI Discovery to locate unregistered agents, a governance dashboard for fleet visibility, a PromptDefense Evaluator for prompt injection auditing, and contributor reputation screening for social engineering detection.
The toolkit supports multiple programming languages through dedicated SDKs: Python with the full feature set, TypeScript, .NET, Go, and Rust implementations covering core governance functions. Installation is available through PyPI for Python, npm for TypeScript, NuGet for .NET, cargo for Rust, and Go modules. As of version 4.1.0, 45 Python packages were consolidated into five distributions: core, runtime, SRE, CLI, and a full meta-package.
According to GitGenius activity tracking, the repository shows strong engagement with a median issue and pull request response latency of zero hours and a mean of eight hours across 700 tracked items. The most active labels are enhancement with 279 items, good first issue with 170, and documentation with 122. Primary contributors include imran-siddique with 1867 tracked events, Ricky-G with 407 events, and miyannishar with 82 events. The repository shares contributors with airbytehq/airbyte, agentops-ai/agentops, and openclaw/openclaw, indicating cross-pollination within the agent framework ecosystem. The toolkit is available in multiple languages including English, Japanese, Simplified Chinese, and Korean, reflecting its intended global adoption.
