wtf is agent-governance-toolkit?

The Agent Governance Toolkit is a Microsoft project that helps companies control what AI agents are allowed to do once they are running in production. AI agents can call tools, browse the web, query databases, and even hand off tasks to other agents, and once deployed they often make decisions on their own. This toolkit answers three basic safety questions: is a given action allowed, which specific agent performed it, and can the company prove afterward what happened and why. Rather than trying to make an AI model behave safely just by asking it nicely in a prompt, which the project argues is not reliable, the toolkit intercepts every tool call, message, and delegation in regular application code before it happens. A policy written in a YAML file decides whether an action is allowed, requires human approval, or gets blocked outright, and every decision is logged for audit purposes. For example, a policy could block any AI agent from dropping a database table while still allowing normal read access. Getting started involves installing the Python package with pip, then wrapping any function a company wants an agent to call with a "govern" wrapper. The toolkit works with any agent framework, not just Microsoft's own tools, and offers software libraries for Python, TypeScript.NET, Rust, and Go, so the same governance rules can apply across different programming languages. It also plugs directly into Claude Code as an installable plugin. The project positions itself around industry compliance frameworks like the OWASP Agentic Top 10, a checklist of common risks in AI agent systems, and cites published research on how often AI models can be tricked into ignoring their instructions. It is currently in public preview, meaning it works but may still change before a full release. The license is MIT, a permissive open source license that allows free use, including for commercial products.