Agent Governance ToolkitAgent Governance Toolkit 4.1.0 · Python 3.10+
Dashboard
0%
1
Curious builder0 XP earned · 300 to level 2
0 daysFinish a lesson to begin
Badge collection0 of 6 unlocked
47 small wins to finish your pathNext lesson →

Agent Governance Toolkit logoAgent Governance Toolkit overview

The Agent Governance Toolkit is Microsoft's open-source layer that sits between an agent deciding to call a tool and the tool running, so a rule, not a prompt, decides what is allowed.

Last updated: 14 Oct, 2026 · Agent Governance Toolkit 4.1.0

An agent that can take actions can be talked into the wrong one. A message that says ignore the rules and close the account is still text to a model, and if the account-closing tool is wired up, the model can call it. Governance puts a gate in front of that call: the agent still decides, but a policy you control gets the final say, and every verdict is written down.

The six pillars

The toolkit advertises six areas. This course teaches the ones that run locally with no key, and names, in each lesson, where the Public Preview does not yet deliver.

  • Policy decides whether an action may run, in Python or in a YAML file.
  • Audit records every decision in a tamper-evident log.
  • Identity gives an agent a cryptographic name it can prove, and a way to delegate without handing over more than it holds.
  • MCP governance checks the tools an agent reaches over the Model Context Protocol, and what they send back.
  • Sandboxing and reliability run an action in a container and add circuit breakers. The policy parts run here; the container parts need Docker and are shown, not run.
  • The mesh ties many agents together. The course uses its identity and audit pieces and leaves the rest.

What you will build

One example grows through the whole course: a support agent for a shop. It starts as a few lines of plain Python that can refund an order, check a status, or close an account. By the end it has a gate on every tool call, a policy in a file, a signed identity, and an audit trail you can prove was not edited. Along the way it also governs a tool server over MCP. Nothing it does needs a model key.

The learning path of the Agent Governance Toolkit course in ten parts, read top to bottom: Why a gate, The gate in Python, Rules in a file, Rules that read the situation, The audit trail, Zero-trust identity, MCP governance, The command line, Running it safely, and a Project, with every lesson listed under its part. 47 lessons in all.

The ten parts

PartLessons
1. Why a gateAgent Governance Toolkit overview, Installation and setup, Why an agent needs governance, Building the shop agent, govern(): the smallest real gate, Governance is opt-in: the fail-open default, What installing gives you, The versions you are running
2. The gate in PythonOne choke point for every tool call, Allow-lists and default deny, Checking a tool's arguments, Writing your own policy rules, Freeze the policy at start-up, Two ways the engine checks a call
3. Rules in a fileWriting a policy in a YAML file, Policy conditions and a missing field, Which rule wins: priority, Defaults: allow, deny, audit and block, Policy scope, Three YAML formats, and which one is real
4. Rules that read the situationPermissions that depend on the context, Conditions on a tool's arguments, Context that changes at runtime, Risk scores
5. The audit trailWhere the audit trail is written, Recording every decision: the flight recorder, Querying the audit log, Proving the audit log's integrity, The audit log as JSONL, Merkle proofs and CloudEvents
6. Zero-trust identityAn agent that can prove who it is, Signing an action and verifying it, Delegation that cannot escalate, Revocation: taking an agent out of service
7. MCP governanceA trust proxy for an MCP server, Scanning what a tool returns, Rug-pull: catching a tool that changed
8. The command lineLinting a policy before it ships, Testing a policy from the command line, What agt verify proves, and what it does not, Checking the toolkit's files with agt integrity
9. Running it safelyShadow mode: trying a policy safely, Both policy engines behind one gate, Sandbox policy, without running a sandbox, Circuit breakers and an error budget
10. ProjectThe governed support agent, Testing the policy in CI
Read this first. The toolkit is a Public Preview. Some of what its docs promise is not wired up in the installed 4.1.0 wheel, and this course says so at each point instead of pretending. One example: a human-approval setting on the first gate is stored and then ignored. You will prove that yourself in the govern() lesson, not take it on faith.
Back toAll frameworks

Every expert started right here.