Microsoft Agent Governance Toolkit: Runtime Security

Release Facts and Scope

OWASP Agentic Top 10 Coverage

The OWASP Agentic AI Top 10 is the canonical threat list for autonomous agents. Microsoft's toolkit ships enforcement for all ten:

The Seven Packages

Agent OS: The Policy Engine

Agent OS is the heart of the toolkit. Stateless. Deterministic. Hooks into every agent action — tool call, memory write, inter-agent message, plugin invocation, outbound network request — and decides allow/deny/transform before execution. Policy decisions are sub-millisecond at p99, so the latency impact on the agent is invisible.

Policy shape

# policy.yaml — illustrative shape
rules:
  - id: block-external-email
    when:
      action: tool_call
      tool: send_email
      to_domain: "!=company.com"
    decision: deny
    reason: "External email sending is not permitted from this agent."

  - id: mask-pii-in-memory-writes
    when:
      action: memory_write
      contains_pii: true
    decision: transform
    transform: mask_pii

  - id: rate-limit-outbound-http
    when:
      action: outbound_http
    decision: allow
    limit:
      max_per_minute: 60
      action_on_exceed: deny

Rules are declarative. Violations are logged automatically to Agent Compliance for audit trails. The evidence is the same structure the EU AI Act asks for — a running record of what the agent attempted and what the policy allowed.

20+ Framework Adapters

Framework-agnostic is the toolkit's most important architectural decision. Each adapter hooks into the framework's native extension point instead of requiring a rewrite:

• LangChain — callback handlers
• CrewAI — task decorators
• Google ADK — plugin system
• Microsoft Agent Framework — middleware pipeline
• Hermes Agent — skill hooks
• AutoGen (legacy) — message interceptors
• LlamaIndex — query/response callbacks
• Semantic Kernel — plugin filters
• n8n / Zapier / custom — generic HTTP adapter

Adding governance to an existing agent is typically three to five lines of configuration — declare the adapter, point it at your policy file, enable compliance evidence collection, done.

The 2026 Regulatory Timeline

EU AI Act / Colorado / HIPAA Mapping

Agent Compliance ships regulatory-framework mappings out of the box. The evidence collected at runtime maps directly to the documentation these frameworks require:

• EU AI Act. Risk management, data governance, logging, human oversight, accuracy and cybersecurity evidence.
• Colorado AI Act. Risk-management programs, impact assessments, consumer notification records.
• HIPAA. Access controls, audit logs, breach- notification evidence for health-data agents.
• SOC 2. Change management, monitoring, incident-response evidence.

Deployment Patterns

Three patterns we see working in production:

Agent Marketplace and Signing

Plugin supply-chain is the OWASP Agentic risk most agencies overlook. Agent Marketplace solves it three ways:

• Ed25519 signing. Every plugin ships signed. Unsigned or invalidly-signed plugins refuse to load.
• Trust tiers. Plugins can be classified (first- party, partner, community). Trust tier gates which capabilities the plugin can request.
• Capability manifests. Plugins declare up-front what they need — network egress hosts, memory access, tools — and the policy engine denies anything outside the declared manifest.

The Adoption Checklist

1. Inventory agent workloads. Which frameworks, which providers, which regulatory regimes touch each?
2. Start with Agent OS. Wire the adapter for your primary framework. Ship a minimal policy (e.g. block external tool calls, rate-limit outbound HTTP).
3. Layer Agent Compliance. Enable evidence collection against the regulatory frameworks that apply to your workloads.
4. Add Agent Mesh if multi-agent. Identity and inter-agent trust become mandatory once agents start talking to each other.
5. Add Agent Marketplace before accepting community plugins. Signing + trust tiers stop supply-chain incidents before they happen.
6. Operate Agent SRE. Telemetry, tracing, health probes — the same maturity level your other production services get.
7. Revisit quarterly. Policy rules evolve. New OWASP guidance evolves. Schedule a quarterly policy review.

Conclusion

Before April 2026, building governed autonomous agents meant stitching guardrails libraries together and documenting the gaps yourself. The Agent Governance Toolkit collapses that into a single MIT-licensed project with 10/10 OWASP coverage, sub- millisecond policy enforcement, and regulatory-framework evidence collection. With Colorado and the EU AI Act enforcement dates hitting this summer, this toolkit is the fastest legitimate compliance path available.

Frequently Asked Questions