Stop Trusting Your AI Agents — Govern Them

You built an AI agent. It works great.

Then one day it deletes a production record. Or passes sensitive salary data to another agent that had no business seeing it. Or a sub-agent spins up another sub-agent, which spins up another, and suddenly you have a runaway chain you didn’t design.

These aren’t bugs. They’re missing policies.

That’s exactly what AGT (Microsoft Agent Governance Toolkit) solves.

What is AGT?

AGT is a Python library that lets you define who can do what in a multi-agent system — and enforces it at the code level, not the prompt level.

pip install agent-governance-toolkit[langgraph]

It gives you three superpowers:

1. Agent → Tool Access Control

The problem: Your research_agent has access to a send_email tool. It was meant for notifications. One day the agent decides to use it mid-task. Nobody asked it to.

With AGT: You write a policy — research_agent cannot call send_email. Done. The call is blocked before it happens.

rules:
  - name: no-email-from-research-agent
    condition: 'tool_name == "send_email" and agent_name == "research_agent"'
    action: deny

The agent receives a structured denial. It doesn’t crash — it just can’t call that tool.

Think of it as firewall rules for tool calls.

2. Agent → Agent Call Restriction

The problem: In a multi-agent system, agents can delegate tasks to other agents. A customer_support_agent probably shouldn't be able to invoke your financial_audit_agent. But without a policy, it can.

With AGT: You define which agents can talk to which. Unauthorized delegation is blocked before the handoff happens.

rules:
  - name: support-cannot-call-audit
    condition: 'caller_agent == "customer_support_agent" and callee_agent == "financial_audit_agent"'
    action: deny

This is especially critical in autonomous workflows where agents spawn sub-agents dynamically. Without this, one misconfigured agent can trigger a chain reaction.

Think of it as access control for your agent org chart.

3. Tool Response Filtering

The problem: Your get_user_profile tool returns {name, email, salary, ssn, address}. Every agent that calls it gets all of it. A junior analyst's agent probably shouldn't see salary and ssn.

With AGT: You configure which fields are visible based on the caller’s role. The tool still runs and returns everything — AGT strips the sensitive fields before the result reaches the agent.

rules:
  - name: hide-sensitive-fields-for-analyst
    condition: 'tool_name == "get_user_profile" and caller_role == "analyst"'
    action: filter_response
    visible_fields: [name, email]

The agent only sees {name, email}. It doesn't know the other fields exist.

Think of it as column-level security for agent responses.

Why Not Just Use Prompt Instructions?

Because prompts are suggestions. A sufficiently complex task, an adversarial input, or simply an unexpected code path can make an LLM ignore its instructions.

AGT enforces at the code layer — before the tool executes, before the handoff happens, before the response is returned. The LLM is never even asked.

The Mental Model

AGT is a policy engine sitting between your agents and the outside world.

Agent wants to call a tool
        ↓
   AGT evaluates rules
        ↓
  ALLOW → tool executes
  DENY  → GovernanceDenied raised → agent handles gracefully
        ↓
   Tool response returned
        ↓
   AGT filters fields by role
        ↓
   Agent sees only what it's allowed to see

Every decision is logged. Every denial is traceable.

When Do You Need This?

• You have multiple agents that can interact with each other
• Your agents have access to sensitive tools or data
• You run a multi-tenant platform where data isolation matters
• You need compliance — someone has to prove agents can’t access what they shouldn’t

If any of these apply, you need AGT.

Bottom Line

AI agents are powerful. Uncontrolled, they’re a liability.

AGT doesn’t slow your agents down — it draws the lines they operate within. You keep the power of autonomous agents, and you keep control over what they can actually do.

GitHub: microsoft/agent-governance-toolkit