Microsoft ships an MIT-licensed agent kernel: policy rings, Ed25519 identity, kill switch

Microsoft released Agent Governance Toolkit (AGT) on 2 April 2026 under an MIT license, a runtime governance framework for autonomous agents with SDKs for Python, TypeScript, Rust, Go and .NET ^[1][2]. The enforcement point is what matters here: according to the dev.to writeup, AGT intercepts actions in the execution path rather than wrapping a model in instructions, on the argument that prompt-level safety is a request and not a control ^[14].

The design borrows openly from systems work. Microsoft's blog, quoted in the writeup, describes production agents as multiple untrusted programs sharing resources, making decisions and interacting with the outside world with almost no mediation, and names kernels, privilege levels and process isolation, service-mesh mTLS, and SRE circuit breakers as the prior art worth copying ^[3]. The components follow that map: four execution rings modelled on CPU privilege levels, Ed25519 decentralised identifiers giving each agent a signing key, an inter-agent trust protocol, and a kill switch whose termination reasons include RATE_LIMIT, RING_BREACH, BEHAVIORAL_DRIFT and MANUAL ^[7][8]. Trust is scored 0 to 1000 across five behavioural tiers and decays, so an agent trusted last week but silent since loses standing rather than holding a permanent grant ^[7].

The policy engine is stateless and accepts YAML rules, OPA Rego or Cedar ^[5][6]. Microsoft puts enforcement latency below 0.1 milliseconds, which is a budget of more than 10,000 sequential decisions per second if taken at face value ^[2][2].

That number is plausible because of the seam the writeup itself admits. The engine runs as an application middleware layer, not an OS kernel layer, and shares a process boundary with the agent it polices; the production recommendation is to run each agent in its own container to get OS-level isolation ^[5]. So the rings are logical, and the isolation that would actually contain a compromised agent comes from the container runtime, as it did before. The operating-system framing is an argument about where controls belong, not a claim to have written a kernel.

The compliance surface is the part procurement will read. Merkle audit logs are tamper-evident and record policy version, action, identity and verdict per decision, with mappings to OWASP Agentic Top 10, NIST AI RMF 1.0, the EU AI Act, SOC 2 Type II, CSA ATF and Singapore's MGF, and an `agt verify` CLI that emits machine-readable evidence files for CI/CD ^[10]. Packaging has already churned once: v4.0.0 consolidated 45 separate packages into 5 top-level distributions, a ninefold reduction, with the old names kept as stubs that redirect ^[4][1].

The concrete policy vocabulary is unglamorous and useful: tool allow and deny lists, blocked content patterns such as `*API_KEY*`, a cap of 50 tool calls per session, a 5.00 USD cost ceiling, and always-on approval gates for `write_file` and `delete_file` ^[18]. Adapters exist for LangChain, CrewAI, Google ADK, Microsoft Agent Framework, OpenAI Agents SDK, LlamaIndex, Haystack and PydanticAI, and all SDKs share one policy evaluation engine and audit schema ^[16][19]. There is a separate MCP Security Gateway for tool poisoning, drift, typosquatting, hidden instruction injection and adversarial content in tool descriptions ^[11].

Watch the deadlines driving this: Colorado's AI Act enforcement starts June 2026, about two months after release, and EU AI Act high-risk obligations take effect August 2026 ^[13][3]. Watch whether the claim of covering all ten items in OWASP's December 2025 Agentic AI Top 10 survives independent review ^[12][20], and whether any auditor treats `agt verify` output as evidence rather than as a build artefact ^[10].