How to Add Independent Verification to Microsoft Agent Governance Toolkit

1. What Microsoft AGT Provides

The Microsoft Agent Governance Toolkit (AGT) is an open-source, MIT-licensed framework that provides runtime security governance for autonomous AI agents. Released in April 2026 and featured at Microsoft Build 2026, AGT covers all 10 OWASP Agentic AI Top 10 risks with deterministic, sub-millisecond policy enforcement.

AGT operates as the runtime enforcement layer:

• PolicyEngine intercepts every tool call, message send, and delegation before execution
• SPIFFE/DID identity assigns unique cryptographic identities to agents
• Ed25519 signing for plugin lifecycle management and marketplace security
• Tamper-evident audit logs document policy decisions
• Framework-agnostic hooks for LangChain, CrewAI, Google ADK, and Microsoft Agent Framework
• Regulatory mapping to EU AI Act, HIPAA, and SOC 2

AGT integrates with Microsoft Foundry Agent Service, Scout autopilots, and the Windows Agent Runtime via the ToolCallInterceptor and PolicyProviderInterface extension points.

2. The Independent Witness Gap

AGT handles runtime enforcement: intercepting actions, applying policies, and logging decisions. This is essential. But regulated enterprises face a second requirement: independent attestation that the governance controls were active, effective, and unmodified during operation.

SWT3 fills this gap by operating as an out-of-band witness layer:

• Cryptographic anchors with SHA-256 fingerprints, independently verifiable by anyone
• Merkle rollups providing tamper-evident daily roots
• Post-quantum signatures (ML-DSA-65) for forward-looking assurance
• Cross-vendor coverage across Microsoft, Google, AWS, and any other provider
• 13 regulatory frameworks (NIST 800-53, CMMC, FedRAMP, EU AI Act, SR 11-7, and more)

The two layers are complementary: AGT enforces policy at runtime. SWT3 attests that enforcement happened, independently.

3. OWASP Agentic Top 10 Crosswalk

7 of 10 risks have full independent attestation coverage. The 3 partial risks (sandboxing, prompt injection, insecure output) depend on runtime detection that AGT performs; SWT3 attests the guardrail was active and records its output.

4. AGA-01: Excessive Agency

# AGT enforces tool scope at runtime
# (Microsoft Agent Governance Toolkit)
from agt.core import PolicyEngine
policy = PolicyEngine.from_yaml("policy.yaml")

# SWT3 independently witnesses every tool call
from swt3_ai import Witness
from swt3_ai.adapters.foundry import wrap_foundry

witness = Witness(
    endpoint="https://sovereign.tenova.io",
    api_key="axm_live_...",
    tenant_id="YOUR_TENANT",
    agent_id="scout-finance-agent",
    signing_key="your-signing-key",
    policy_version="v2.1.0",
)

# Wrap the Foundry agent -- witnesses execute() and interceptToolCall()
agent = wrap_foundry(my_foundry_agent, witness=witness)
result = agent.execute("Summarize Q4 earnings from the shared drive")

5. AGA-02: Inadequate Sandboxing

6. AGA-03: Unmonitored Execution

# SWT3 chain monitoring produces forensic timelines
from swt3_ai import ChainMonitorExporter

exporter = ChainMonitorExporter(wal_path="/tmp/swt3-wal/YOUR_TENANT")
report = exporter.build_report()

# Export HTML forensic timeline for auditors
with open("audit-trail.html", "w") as f:
    f.write(exporter.export_html())

7. AGA-04: Prompt Injection

8. AGA-05: Insecure Output Handling

9. AGA-06: Agent Identity Spoofing

# Dual identity: AGT platform identity + SWT3 auditor identity
witness = Witness(
    endpoint="https://sovereign.tenova.io",
    api_key="axm_live_...",
    tenant_id="YOUR_TENANT",
    agent_id="scout-finance-agent",      # SWT3 independent identity
    signing_key="your-hmac-key",          # HMAC-SHA256 payload signing
    signing_algorithm="hmac-sha256",      # Or "ml-dsa-65" for post-quantum
)

10. AGA-07: Knowledge Poisoning

11. AGA-08: Privilege Escalation

12. AGA-09: Supply Chain Compromise

13. AGA-10: Insufficient Logging

14. Quick Start: AGT + SWT3

Python

# pip install swt3-ai

from swt3_ai import Witness
from swt3_ai.adapters.foundry import wrap_foundry

# Initialize the independent witness layer
witness = Witness(
    endpoint="https://sovereign.tenova.io",
    api_key="axm_live_...",
    tenant_id="YOUR_TENANT",
    agent_id="scout-document-agent",
    signing_key="your-hmac-key",
)

# Wrap your Foundry agent (duck-typed, no Microsoft SDK dependency)
agent = wrap_foundry(my_agent, witness=witness)

# Every execute() call is now independently witnessed
result = agent.execute("Summarize the compliance report")

# Every tool interception is also witnessed
result = agent.intercept_tool_call("search", {"query": "audit findings"})

TypeScript

// npm install @tenova/swt3-ai

import { Witness } from "@tenova/swt3-ai";
import { wrapFoundry } from "@tenova/swt3-ai/adapters/foundry";

const witness = new Witness({
  endpoint: "https://sovereign.tenova.io",
  apiKey: "axm_live_...",
  tenantId: "YOUR_TENANT",
  agentId: "scout-document-agent",
  signingKey: "your-hmac-key",
});

// Wrap the Foundry agent
const agent = wrapFoundry(myAgent, witness);

// Every execution is independently witnessed
const result = await agent.execute("Summarize the compliance report");

Using the Foundry Profile

# Initialize with the microsoft-foundry profile
# swt3 init --profile microsoft-foundry

# swt3.yaml (auto-generated)
profile: microsoft-foundry
api_key_env: SWT3_API_KEY
tenant_id: YOUR_TENANT
agent_id: your-foundry-agent
signing_key_env: SWT3_SIGNING_KEY

15. Foundry Profile Reference

The microsoft-foundry profile pre-configures SWT3 for Foundry Agent Service deployments:

16. Coverage Summary

When AGT and SWT3 operate together:

• AGT provides sub-millisecond runtime enforcement, SPIFFE/DID identity, and platform-level audit logs
• SWT3 provides independent cryptographic attestation, Merkle-rooted audit trails, and cross-vendor evidence
• 7 of 10 OWASP Agentic risks have full independent attestation coverage
• 3 of 10 have partial coverage (sandboxing, prompt injection, output safety) where AGT handles detection and SWT3 attests the guardrail was active
• Evidence is verifiable by any auditor, Notified Body, or C3PAO using only a fingerprint string
• No Microsoft infrastructure access required for verification