Agent Governance Toolkit：管控智能体工具调用

AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous A…

🌍 English | Español | 日本語 | 简体中文 | 한국어 | 繁體中文 Agent Governance Toolkit Ship agents to production without losing sleep 🚀 Quick Start · 📋 Specifications · 📦 PyPI · 📝 Changelog Important Public Preview -- production-quality public preview releases. May have breaking changes before GA. Policy enforcement, identity, sandboxing, and SRE for autonomous AI agents. One pip install, any framework. The Problem Your AI agents call tools, browse the web, query databases, and delegate to other agents. Once deployed, they make decisions autonomously. You need answers to three questions: 1. Is this action allowed? An agent with access to send_email and query_database should not be able to drop_table. OAuth scopes and IAM roles control which services an agent can reach, not what it does once connected. 2. Which agent did this? In a multi-agent system, five agents might share a single API key. When something goes wrong, "an agent did it" is not an incident response. 3. Can you prove what happened? Auditors and regulators need tamper-evident records of every decision: what policy was active, what the agent requested, and why it was allowed or denied. Prompt-level safety ("please follow the rules") is not a control surface. It is a polite request to a stochastic system. OWASP LLM01:2025 states this explicitly: "it is unclear if there are fool-proof methods of prevention for prompt injection." The published numbers back this up. Andriushchenko et al. (ICLR 2025) report 100% attack success rate on GPT-4o, GPT-3.5, Claude 3, and Llama-3 using adaptive attacks with logprob access and suffix optimization, evaluated against the JailbreakBench benchmark (Chao et al., NeurIPS 2024). Microsoft's own AI Red Teaming Agent formalizes Attack Success Rate (ASR), the rate of policy violations under adversarial input, as the canonical metric for this class of failure. Lessons from Red Teaming 100 Generative AI Products reinforces the point: "mitigations do not eliminate risk entirely" and red teaming must be a continuous process because model-layer defenses are probabilistic by construction. AGT does not try to win that fight inside the prompt. Every tool call, message send, and delegation is intercepted in deterministic application code before the model's intent reaches the wire. Actions the AGT kernel denies are not "unlikely." They are structurally impossible. That is the difference between asking an agent to behave and making it incapable of misbehaving. Quick Start Prerequisites: Python 3.11+ pip install "agent-governance-toolkit[full]" Use the [full] extra for the quick-start imports below. The base agent-governance-toolkit wheel installs the compliance CLI only; the governance modules live in the consolidated core distribution. The agentmesh quick-start import remains the current wrapper API. Importing agent_os emits a DeprecationWarning because the old agent-os-kernel distribution is deprecated. Use agent-governance-toolkit-core (or the [full] extra that includes it) as the replacement distribution. Policy-engine host code uses the ACS SDK; agt-policies provides the one-way v4-to-v5 migration command. The pre-ACS agent_os.policies rule model is gone, and BREAKING_CHANGES.md lists its replacements. The policy engine is published upstream as agent-control-spec. agent-hooks defines its interception contract. AGT retains the AgentControl host APIs and framework adapters in policy-engine/, not a second decision engine. This keeps policy evaluation in one place. AGT can adopt upstream fixes through a dependency update while keeping its host APIs and framework integrations. See the ACS package guide for the distinction between upstream packages and AGT's compatibility SDKs. For Claude Code, add AGT as a plugin marketplace and install the governance plugin: /plugin marketplace add microsoft/agent-governance-toolkit /plugin install agt-governance@agent-governance-toolkit Govern any tool function in two lines: from agentmesh.governance import govern safe_tool = govern(my_tool, policy="policy.yaml") # every call checked, logged, enforced On every call, safe_tool evaluates the YAML policy, logs the decision to an audit trail, and raises GovernanceDenied when the policy blocks the action. # policy.yaml apiVersion: governance.toolkit/v1 name: production-policy default_action: allow rules: - name: block-destructive condition: "action.type in ['drop', 'delete', 'truncate']" action: deny description: "Destructive operations require human approval" - name: require-approval-for-send condition: "action.type == 'send_email'" action: require_approval approvers: ["security-team"] >>> safe_tool(action="read", table="users") {'table': 'users', 'rows': 42} >>> safe_tool(action="drop", table="users") GovernanceDenied: Action denied by policy rule 'block-destructive': Destructive operations require human approval Or use the full AgentControl API for programmatic control: AgentControl example from agent_control_specification import AgentControl runtime = AgentControl.from_path(str("manifest.yaml")) result = runtime.evaluate( "input", { "envelope": {"agent_id": "example-agent"}, "input": {"body": {"action": "web_search", "params": {}}}, }, ) print(result.verdict) runtime.close() Run the complete ACS email-tool example. TypeScript / .NET / Rust / Go examples TypeScript import { PolicyEngine } from "@microsoft/agent-governance-sdk"; const engine = new PolicyEngine([ { action: "web_search", effect: "allow" }, { action: "shell_exec", effect: "deny" }, ]); engine.evaluate("web_search"); // "allow" engine.evaluate("shell_exec"); // "deny" .NET using AgentGovernance; using AgentGovernance.Extensions.ModelContextProtocol; using AgentGovernance.Policy; var kernel = new GovernanceKernel(new GovernanceOptions { PolicyPaths = new() { "policies/default.yaml" }, }); var result = kernel.EvaluateToolCall("did:mesh:agent-1", "web_search", new() { ["query"] = "latest AI news" }); // MCP server integration builder.Services.AddMcpServer() .WithGovernance(options =