Control and audit AI agent actions at the code level
When an agent sends an email or modifies a database, a mechanism is needed to check in real time whether the action is permitted and to leave a record. This tool intercepts all agent tool calls, allows or denies them based on policy, and generates an audit log that tracks who performed which action. Instead of asking the prompt to 'behave well,' it enforces 'this is not allowed' through code.
The limits of prompt safety and deterministic blocking
Most AI safety mechanisms operate at the prompt level, which is merely a polite request to a probabilistic system. Research indicates that defending against prompt injection via adversarial attacks is nearly impossible. This tool intercepts all actions with deterministic application code before the model's intent is transmitted over the network. Actions denied by policy become structurally impossible rather than just 'unlikely.' This is the difference between asking an agent not to misbehave and making it unable to misbehave.
Combining policy engine and audit trail
All tool calls are evaluated against YAML policy files. Permitted actions are executed, while denied actions raise exceptions. Simultaneously, every decision is recorded in a tamper-proof audit log, proving which policy was applied, what the agent requested, and why it was allowed or denied. This process automatically generates the evidence required by auditors or regulatory bodies. Even in multi-agent systems sharing a single API key, each agent's actions can be individually identified and tracked.
Support for various languages and frameworks
SDKs are provided for five languages: Python, TypeScript, .NET, Rust, and Go, with Python supporting the full stack. It integrates with major agent frameworks such as Microsoft Agent Framework, Semantic Kernel, AutoGen, LangGraph, and CrewAI. It can also be installed as a plugin for developer tools like Claude Code or Copilot CLI. Starting from v4.1.0, 45 packages have been consolidated into 5 top-level distributions, simplifying installation and management. Each language SDK implements core governance functions: policy, identity, trust, and audit.
Compliance with standards and security boundaries
It addresses all risk categories of the OWASP Agentic AI Top 10 with deterministic controls and provides alignment with major standards such as NIST AI RMF, EU AI Act, and SOC 2. 992 compliance tests ensure that the code matches the specification. However, this tool enforces governance at the application middleware level, not the operating system kernel level. Therefore, in production environments, it is recommended to run each agent in a separate container for OS-level isolation. Code quality and vulnerabilities are managed using various security tools such as CodeQL, Gitleaks, and ClusterFuzzLite.
Cautions for the public preview stage
This project is currently in the public preview stage, and breaking changes may occur before General Availability (GA). It is distributed under the MIT license, and official sources are available only from specific paths on GitHub, PyPI, npm, NuGet, and crates.io. When used with third-party agent frameworks or services, the user is responsible for data sharing and retention. Before adoption, it is recommended to check the installation status with the agt doctor command and verify OWASP compliance with agt verify. In particular, you should check BREAKING_CHANGES.md for the fact that the policy engine's host code uses the ACS SDK and for compatibility issues with previous versions.
