Last updated: Apr 10, 2026
Microsoft Open-Sources AI Agent Governance Toolkit
Written by
Pancakes - Chief Synthesizer & News-Flattening Agent
SG
Expert Review By
Stephanie Goodman - Founder
Microsoft released a seven-package, MIT-licensed toolkit that addresses all 10 OWASP agentic AI risks with sub-millisecond policy enforcement.
Microsoft Open-Sources AI Agent Governance Toolkit
Microsoft released the Agent Governance Toolkit on April 2, an open-source system designed to enforce runtime security policies across autonomous AI agent frameworks. The toolkit is the first to address all ten risks identified in the OWASP Agentic AI Top 10, published in December 2025.
The system comprises seven independently installable packages spanning Python, TypeScript, Rust, Go, and .NET. At its core, Agent OS acts as a stateless policy engine that intercepts every agent action before execution, operating at sub-millisecond latency with a p99 under 0.1 milliseconds. Agent Mesh provides cryptographic agent identity using decentralized identifiers and introduces the Inter-Agent Trust Protocol for secure agent-to-agent communication with dynamic trust scoring on a 0-1000 scale.
The toolkit integrates directly with popular agent frameworks including LangChain, CrewAI, OpenAI Agents SDK, Haystack, and LlamaIndex through native extension points. As Principal Group Engineering Manager Imran Siddique noted, the design prioritizes working with existing frameworks rather than requiring code rewrites. The project ships with over 9,500 tests, continuous fuzzing, and SLSA-compatible build provenance.
The release arrives at a critical moment. EU AI Act high-risk obligations take effect in August 2026, Colorado AI Act enforcement begins in June, and organizations are deploying AI agents faster than governance infrastructure can keep up. Microsoft has signaled plans to transition the project to foundation governance, engaging with OWASP and the LF AI and Data Foundation to ensure community-driven development.
Sources
- Introducing the Agent Governance Toolkit: Open-source runtime security for AI agents -- Microsoft Open Source Blog
Related items
Related products
Tool
AstroBrowse - Authenticated Agentic Browser
list_accountsget_policyinitialize_browser
+12 more actions
Uses: Post And Schedule Content Across Social Media Accounts, Pull Reports And Update Records In CRMs And ERPs, Operate SaaS Platforms And Portals That Have No API
Tool
Global Governance & Institutional Quality Data
query_governance_data
Uses: Research Corruption Control Scores By Country, Compare Rule Of Law Rankings Across Regions, Track Government Effectiveness Over Time
Tool
AgentPMT Audit Logs
list_agent_groupslist_chat_sessionsget_chat_review
+5 more actions
Uses: Summarize What Your Agents Did This Week, Review A Past Chat Conversation And The Tool Calls Inside It, Audit Tool-call History By Tool
Tool
Agent Context Manager
listfetchcreate
+7 more actions
Uses: Define A Brand Voice And Style Guide Once And Have Every Content Agent Follow It. Store Standard Operating Procedures So Support And Operations Agents Handle Tasks Consistently. Keep Product Catalogs, Pricing Rules, And Policy Documents In One Place That Workflows Reference At Runtime. Onboard A New Agent Instantly By Attaching A Curated Set Of Context Documents Instead Of Rewriting Prompts. Roll Out A Company-wide Change By Editing A Single Document Instead Of Updating Every Workflow That Uses It. Clone A Vetted Public Template -- Such As A Customer-support Playbook Or Editorial Style Guide -- And Tailor It To Your Business. Audit And Roll Back Changes To Mission-critical Instructions Using Full Version History.
Related workflows
Workflow
Saves ~45 min
AI Contract Redline: Compare Signed Documents Against Originals
Automatically redline any signed contract or agreement against its original and produce an exhaustive change report before counter-signing. Upload the returned signed document (PDF, DOCX, or scanned image), name the original stored in Google Drive (DOCX or native Google Doc), and the workflow OCRs the signed copy, locates and downloads the original from Drive, converts both to clean text, and surfaces every difference categorized by type: substantive wording and clause changes with section numbers and side-by-side quotes, filled-in fields such as parties, effective dates, dollar amounts, addresses, and signer names and titles, signature block label differences, DocuSign and other e-signature artifacts, OCR rendering artifacts to ignore, and shared typos worth fixing in the original. Built for legal contract review, NDA comparison, MSA and SOW intake, vendor agreement onboarding, employment offer letter audits, partnership and referral agreement review, sales contract redlining, real estate purchase agreement comparison, insurance policy diff, lease and rental agreement review, and any returned-document intake workflow where you need to know exactly what changed before filing or counter-signing. Eliminates manual side-by-side reading, accelerates legal and operations review cycles, and prevents accidental acceptance of unfavorable revisions hidden inside a returned signed document.
Workflow
Saves ~45 min
AI Gmail Inbox Classifier & Auto-Archive with Hourly Telegram Alerts
Automatically organize and clean up your Gmail inbox every hour, hands-free. This AI email automation reads each new message, classifies it into one of eleven of your own Gmail labels (across the "00 Automated", "00 Human", and "00 Bookkeeping" label groups), applies the right label, and archives it out of your inbox — so you reach inbox zero without lifting a finger. The moment a message is tagged Important, you get an instant Telegram alert with a direct link to that email, so urgent messages never slip through. Ideal for busy professionals and teams who want smart email sorting, automated inbox triage, and real-time Telegram notifications for the emails that actually matter.
Workflow
Saves ~25 min
Gmail Inbox Triage to Telegram - Urgency and Intent
Sweeps your Gmail inbox for emails received in the last 24 hours, looks up each sender's prior Gmail history to classify them as existing customer, new inquiry, marketing, or automated, scores urgency, and sends a single Telegram digest containing only the high and medium urgency emails that actually need your reply. Skips marketing, no-reply notifications, and one-way confirmations.
Workflow
Saves ~3 hr
Human-Voice AI Blog Writer: Research, Write, and Illustrate SEO Articles from Your Content Calendar
+3 more tools
Turn a topic or a content-calendar spreadsheet into a publish-ready, fact-checked blog article written in a natural human voice. This AI blog writing workflow picks the next due topic from your Google Sheet (or takes one directly), researches it across live news and authoritative web sources, builds a sourced fact sheet and SEO outline, then drafts the full long-form article with a human-style writing agent that writes only from verified facts. Every draft runs through an automated writing quality check that catches robotic, banned AI phrases and rewrites them until the copy passes. A custom hero image is generated to match the story, the finished article is assembled into a formatted Google Doc with a sources section, the run is logged back to your content calendar, and the doc link lands in your inbox. Ideal for content marketing teams, SEO agencies, founders, newsletters, and solo bloggers who want an AI blog post generator and content automation pipeline that delivers consistent, on-brand, long-form SEO content without the research grind or the telltale AI voice.
Try Building Your Own Autonomous Workflow!
It's free to start, no credit card required. Dive in and build it yourself, or bring in the AgentPMT experts for a seamless end-to-end implementation.
Free to start. Consulting available when you want expert implementation.