Why governance has to sit outside the agent.
If governance runs inside the agent's trust boundary, anything that compromises the agent can turn governance off. Panopticore runs outside it.
The bypass-by-architecture argument.
“Many current agent governance approaches are implemented as middleware within the agent's own runtime. This means a sufficiently capable agent, a compromised dependency, or a malicious actor with access to the agent's process can bypass governance entirely. The governance mechanism and the entity being governed share the same trust boundary. This is analogous to relying on an application to enforce its own access controls without an external authentication service, a pattern that the security community abandoned decades ago.”
This passage is from a formal comment submitted by Panoptic Systems to the National Institute of Standards and Technology on Security Considerations for Artificial Intelligence Agents (Docket NIST-2025-0035, 91 FR 698), February 2026.
Read the full NIST comment →Deterministic governance requires architectural separation.
AI systems cannot reliably govern themselves. When the system producing the evidence is the system under review, the evidence cannot be trusted on its own.
Deterministic enforcement needs a control point outside the agent's process and trust boundary, one that decides whether an action proceeds before it reaches the target system.
Microsoft's Agent Governance Toolkit and other framework-layer approaches also describe themselves as deterministic. The difference is where enforcement runs: Panopticore enforces at the network layer, in a separate trust boundary from the agent, and produces its evidence there.
“deterministic infrastructure-level governance that provided audit-grade evidence”
How the approaches differ.
Both in-process and infrastructure-layer approaches are useful; they answer different questions.
| Dimension | Microsoft Agent Governance Toolkit | App-layer / framework approaches | Panopticore |
|---|---|---|---|
| Deployment | SDK middleware in agent framework | SDK middleware in agent framework | Network sidecar, no framework integration |
| Trust boundary | Same as agent (per their README) | Same as agent or framework | Separate from agent |
| Framework coupling | Framework adapters (LangChain, CrewAI, ADK, etc.) | Framework middleware (LangGraph, ADK, Strands) | Vendor and framework neutral |
| Audit evidence | Signed records, produced inside the agent's process | Trajectory logs, vendor dashboards | Offline-verifiable Evidence Binder, produced outside the agent's process |
Microsoft Toolkit claims cite Microsoft's own GitHub README (Security section).
Microsoft Agent 365.
Microsoft Agent 365, generally available since May 2026 and distinct from the open-source Toolkit above, is Microsoft's control plane for agents: a registry, access control through Microsoft Entra, and compliance through Microsoft Purview, for agents built on Microsoft platforms and for partner agents.
Panopticore runs in your own VPC, governs the outbound calls you route through it from any agent on any platform, and produces Evidence Binders a third party can verify offline.
The scopes differ, so the two can run together.
First to combine three properties.
Panopticore is the first system to combine three properties:
Further reading
Pre-deployment review, model evaluation, and prompt engineering all happen before the agent acts. Runtime governance happens when it acts.
An architectural read of Microsoft's open-source Agent Governance Toolkit, and how it differs from Panopticore and Microsoft Agent 365.