Microsoft released the Agent Governance Toolkit as open source. This post looks at where it sits architecturally. Both tools are useful; they answer different questions.
What the Toolkit does
The Agent Governance Toolkit is SDK middleware that integrates into agent frameworks. It provides policy evaluation, approval workflows, a tamper-evident audit log with signed decision receipts that can be verified offline, and a governance dashboard. It also ships a unified CLI, agent lifecycle management, shadow AI discovery, an MCP security gateway, and an A2A bridge.
It hooks into frameworks through their extension points: LangChain callback handlers, CrewAI task decorators, Google ADK plugins, and the Microsoft Agent Framework middleware pipeline.
Where it sits architecturally
Microsoft’s own README, in its Security section, says the toolkit “enforces governance at the application middleware layer, not at the OS kernel level” and that “the policy engine and agents share the same process boundary.”
So the toolkit shares the agent’s trust boundary. Microsoft’s own production recommendation is to run each agent in a separate container for OS-level isolation.
Who it suits
For many development teams, in-process governance is the right fit. If you want policy enforcement and signed audit records inside your agent framework, the Toolkit does that well.
For teams that need evidence an external auditor, regulator, or insurance carrier will rely on, the trust-boundary question matters. Evidence signed inside the agent’s process is only as trustworthy as that process. Panopticore produces its Evidence Binder outside the agent’s trust boundary, and any third party can verify it offline.
Agent 365 is a separate product
Microsoft Agent 365 is a distinct product from the open-source toolkit. Generally available since May 2026, it is Microsoft’s control plane for agents: a registry in the Microsoft 365 admin center, access control through Microsoft Entra, and compliance through Microsoft Purview, covering agents built on Microsoft platforms and partner agents.
Panopticore governs at the network layer on any platform, including M365 agents that call external systems.
The comparison
| Dimension | Agent Governance Toolkit | Panopticore |
|---|---|---|
| Deployment | SDK middleware in agent framework | Network sidecar, no framework integration |
| Trust boundary | Same as agent (per Microsoft’s README) | Separate from agent |
| Framework coupling | Framework adapters | Vendor and framework neutral |
| Audit evidence | Signed records, produced inside the agent’s process | Evidence Binder, produced outside the agent’s process |
The choice depends on the question you need answered: “can my framework enforce policy in-process?” or “can I prove to an auditor what this agent did, with evidence the agent could not touch?”
For a comparison that also covers other framework-layer approaches, see Why Panopticore.
