How to install Microsoft Agent Governance Toolkit and evaluate a tool call

Agent frameworks will call a tool if you let them. Microsoft’s Agent Governance Toolkit puts a policy check in front of that moment. You install the package, generate a native ACS manifest, lint it, then evaluate a proposed tool call before anything executes. Treat this as a policy-enforcement how-to: deny or allow the action, then keep an audit path.

The official quickstart states the split clearly. Use a native ACS manifest for policy and an Agent OS adapter for framework lifecycle mediation. Policy stays in the manifest. The adapter only receives the runtime.

Install the toolkit

In a Python environment, install the extra the quickstart names:

pip install agent-governance-toolkit[full]

Use that exact extra. A slimmer install is not documented on this path.

Generate a starter bundle and lint it

Scaffold a policy directory from the strict template, then lint the generated manifest:

python -m agent_os.cli.cmd_policy_gen \
  --template strict \
  --output policies/
agt lint-policy policies/manifest.yaml

The generated directory contains manifest.yaml and policy.rego. The manifest binds the Rego policy to native intervention points.

Evaluate a tool call before it runs

Load the manifest into AgentControl, open a HostSession, and evaluate a sample action. The quickstart uses a delete_file action on report.txt:

from agent_control_specification import AgentControl, HostSession

runtime = AgentControl.from_path("policies/manifest.yaml")
session = HostSession(
    runtime,
    agent_id="quickstart-agent",
    session_id="quickstart-session",
)

evaluation = session.pre_tool_call(
    tool_name="delete_file",
    args={"path": "report.txt"},
)

print(evaluation.verdict)
print(evaluation.reason_code)

That load builds the runtime from the manifest you just generated. The session identifies the agent as quickstart-agent and the session as quickstart-session. The evaluation is the enforcement point: tool name and args in, verdict and reason code out.

The quickstart also records an accounting rule that is easy to miss. Attempted tool calls are charged before evaluation, including denied attempts. The runtime itself remains free of session counters. Do not expect the AgentControl object to hold those counters.

Attach a LangChain adapter

When the agent already lives in LangChain, pass the same runtime into the adapter:

from agent_os.integrations.langchain_adapter import LangChainKernel

kernel = LangChainKernel(runtime=runtime)

Every supported adapter receives the native runtime through runtime=. Policy definitions, blocked content, tool catalogs, budgets, transforms, and approval belong in the manifest rather than the adapter constructor.

That list is the design constraint. If you need a blocked-content rule, a tool catalog, a budget, a transform, or an approval flow, put it in the manifest. Those concerns do not belong on LangChainKernel.

The tutorials index lists Framework Integrations as the getting-started guide for connecting AGT to LangChain, CrewAI, OpenAI, and similar stacks. The constructor pattern is the same idea: hand the adapter the runtime you already built from the manifest.

Handle a denial and keep an audit record

If the decision does not permit the call, turn the evaluation into PolicyViolationError instead of executing the tool:

from agent_os.exceptions import PolicyViolationError

if not evaluation.verdict.decision.permits:
    error = PolicyViolationError.from_evaluation_result(evaluation)
    print(str(error))
    print(error.evaluation_result.audit_record())

The public exception text is sanitized. Trusted code can use the attached PolicyEvaluation for structured audit and dispatch.

That split is the audit path. Callers and logs see a sanitized string. Your host can still use the attached evaluation for structured records. If you need to prove what the policy decided after a deny, keep that second object—not only the public exception text.

After the quickstart

The GitHub quickstart points at four follow-on topics: Agent Control Specification, Framework integrations, Policy testing, and Progressive governance. Microsoft’s tutorials site groups those as step-by-step guides by task and role.

If you are new to AGT, that index says to start with the 2-Line Quickstart, then Policy Engine Basics. Getting Started also includes Agent Control Specification (a direct ACS policy enforcement point with allow, transform, and deny verdicts), Framework Integrations, and Progressive Governance—start simple, add layers incrementally.

Five learning paths sit above the catalog. Path 1 (about 30 minutes) is for developers adding governance to a first agent. Path 2 (about 50 minutes) is for platform engineers building adapters, gateways, or custom runtimes on the canonical AGT 5 decision contract, including OPA / Rego / Cedar and routing escalate verdicts. Path 3 covers securing an agent fleet. Path 4 is compliance and audit. Path 5 is SRE for agents. A Policy-as-Code series includes Policy Testing, which matches the quickstart’s next-step list.

Do not invent extra CLI flags or adapter keyword arguments beyond what appears above. The exact contents of the generated policy.rego file are not shown in the quickstart; treat that as unknown until you open the file on disk or read the policy-engine tutorials.

Run the install, generate the policies directory with the strict template, lint the generated manifest, and execute the sample evaluation against delete_file. When you can print a verdict and handle PolicyViolationError, open the tutorials index linked below and follow Path 1: First governed agent, or the Agent Control Specification tutorial if you are building the host yourself.

Sources

• Quickstart
• Tutorials