microsoft / agent-governance-toolkit

Agent Governance Toolkit

Ship agents to production without losing sleep 🚀 Quick Start · 📋 Specifications · 📦 PyPI · 📝 Changelog

智能体治理工具包

让智能体安全上线，从此高枕无忧 🚀 快速开始 · 📋 规范说明 · 📦 PyPI · 📝 更新日志

Important: Public Preview — production-quality public preview releases. May have breaking changes before GA. Policy enforcement, identity, sandboxing, and SRE for autonomous AI agents. One pip install, any framework.

重要提示： 公共预览版——具备生产质量的公共预览发布。在正式发布（GA）前可能会有重大变更。为自主 AI 智能体提供策略执行、身份验证、沙箱隔离和 SRE（站点可靠性工程）支持。只需一次 pip 安装，适配任何框架。

The Problem

Your AI agents call tools, browse the web, query databases, and delegate to other agents. Once deployed, they make decisions autonomously. You need answers to three questions:

问题所在

你的 AI 智能体可以调用工具、浏览网页、查询数据库并委派任务给其他智能体。一旦部署，它们便会自主做出决策。你需要回答以下三个问题：

Is this action allowed? An agent with access to send_email and query_database should not be able to drop_table. OAuth scopes and IAM roles control which services an agent can reach, not what it does once connected.
Which agent did this? In a multi-agent system, five agents might share a single API key. When something goes wrong, “an agent did it” is not an incident response.
Can you prove what happened? Auditors and regulators need tamper-evident records of every decision: what policy was active, what the agent requested, and why it was allowed or denied.
此操作是否被允许？ 一个拥有 send_email 和 query_database 权限的智能体，不应具备 drop_table（删除表）的能力。OAuth 作用域和 IAM 角色控制的是智能体能访问哪些服务，而不是它在连接后能做什么。
是哪个智能体执行的？ 在多智能体系统中，五个智能体可能共享同一个 API 密钥。当出现问题时，“有个智能体干的”并不能作为事故响应。
你能证明发生了什么吗？ 审计人员和监管机构需要每一项决策的防篡改记录：当时生效的策略是什么、智能体请求了什么，以及为什么该请求被允许或拒绝。

Prompt-level safety (“please follow the rules”) is not a control surface. It is a polite request to a stochastic system. OWASP LLM01:2025 states this explicitly: “it is unclear if there are fool-proof methods of prevention for prompt injection.”

提示词层面的安全性（即“请遵守规则”）并非一种控制手段，它只是对随机系统的一种礼貌请求。OWASP LLM01:2025 明确指出：“目前尚不清楚是否存在防止提示词注入的万无一失的方法。”

Lessons from Red Teaming

AGT does not try to win that fight inside the prompt. Every tool call, message send, and delegation is intercepted in deterministic application code before the model’s intent reaches the wire. Actions the AGT kernel denies are not “unlikely.” They are structurally impossible. That is the difference between asking an agent to behave and making it incapable of misbehaving.

红队测试的经验教训

AGT 并不试图在提示词层面解决这个问题。每一次工具调用、消息发送和任务委派，都会在模型意图到达网络之前，在确定性的应用程序代码中被拦截。被 AGT 内核拒绝的操作并非“不太可能发生”，而是“结构上不可能发生”。这就是“要求智能体表现良好”与“使其无法作恶”之间的区别。

Quick Start

Prerequisites: Python 3.10+ pip install agent-governance-toolkit[full]

快速开始

先决条件：Python 3.10+ pip install agent-governance-toolkit[full]

Govern any tool function in two lines:

from agentmesh.governance import govern
safe_tool = govern(my_tool, policy="policy.yaml") # every call checked, logged, enforced

That’s it. safe_tool evaluates your YAML policy on every call, logs the decision, and raises GovernanceDenied if the action is blocked.

只需两行代码即可治理任何工具函数：

from agentmesh.governance import govern
safe_tool = govern(my_tool, policy="policy.yaml") # 每次调用都会被检查、记录并强制执行

就是这样。safe_tool 会在每次调用时评估你的 YAML 策略，记录决策结果，如果操作被拦截，则会抛出 GovernanceDenied 异常。

TypeScript / .NET / Rust / Go examples

(See original article for code snippets)

TypeScript / .NET / Rust / Go 示例

（代码片段请参考原文）