Saram ConsultingIn April 2026, Microsoft open-sourced the Agent Governance Toolkit — seven packages, MIT-licensed, claiming to address all 10 OWASP Agentic AI risks with sub-millisecond policy enforcement. In May, Google Cloud Next ’26 unveiled Agent Identity, Agent Gateway, and Model Armor as first-class platform services. AWS had already shipped Bedrock AgentCore with Cedar-based deterministic policy enforcement back in December 2025.
Three of the largest infrastructure companies on earth have now staked out their positions on the same question: how do you enforce security boundaries around AI agents that reason, plan, and act autonomously? The answers are architecturally different, philosophically opposed in places, and collectively the most important infrastructure decision facing any team deploying agents in production this year.
This post breaks down all three approaches, maps them against the OWASP Agentic Top 10, and gives you a decision framework for choosing.
Why this matters now
AI agents are no longer chatbots. They book flights, execute trades, write and deploy code, manage infrastructure, query databases, send emails, and trigger financial transactions. Frameworks like LangChain, AutoGen, CrewAI, and the Microsoft Agent Framework have made building these agents absurdly easy. The governance infrastructure has not kept pace.
Two regulatory deadlines make this urgent:
- EU AI Act high-risk obligations take effect in August 2026
- Colorado AI Act becomes enforceable in June 2026
The OWASP GenAI Security Project published the first formal taxonomy of agentic AI risks in December 2025 — the Top 10 for Agentic Applications. Every platform discussed here claims to address it. The question is how deeply and how honestly.
The OWASP Agentic Top 10: What we’re defending against
Before comparing platforms, you need to understand what they’re trying to solve. The OWASP Agentic Top 10 defines ten risk categories specific to autonomous AI agents:
| ID | Risk | The problem in one sentence |
|---|---|---|
| ASI01 | Agent Goal Hijack | Attackers redirect what the agent is trying to achieve |
| ASI02 | Tool Misuse & Exploitation | Agents use legitimate tools in unsafe or unintended ways |
| ASI03 | Identity & Privilege Abuse | Delegation chains and cached credentials get exploited |
| ASI04 | Agentic Supply Chain | Malicious plugins, MCP servers, or third-party agents |
| ASI05 | Unexpected Code Execution | Agent generates or runs unintended code |
| ASI06 | Memory & Context Poisoning | Stored context gets corrupted across sessions |
| ASI07 | Insecure Inter-Agent Communication | Agent-to-agent messages intercepted or forged |
| ASI08 | Cascading Failures | One agent’s error propagates across the system |
| ASI09 | Human-Agent Trust Exploitation | Social engineering via agents |
| ASI10 | Rogue Agents | Agents operating outside intended parameters autonomously |
The OWASP framework introduces a critical concept: Least-Agency. It extends Least-Privilege by arguing that you shouldn’t deploy agentic behavior where it isn’t needed — unnecessary autonomy expands the attack surface without adding value. This is the philosophical backbone every governance platform has to answer to.
Microsoft Agent Governance Toolkit: The OS Kernel Metaphor
Released: April 2, 2026 | License: MIT | Languages: Python, TypeScript, Rust, Go, .NET
Microsoft looked at AI agents and saw the same problem operating systems solved decades ago: multiple untrusted programs sharing resources, making decisions, and interacting with the outside world with limited mediation. Their answer is to borrow the kernel, privilege rings, and process isolation patterns that have worked for 40 years and apply them to agents.
The toolkit has seven independently installable packages:
Agent OS is the core — a stateless policy engine that intercepts every agent action before execution. It supports three policy languages (YAML rules, OPA Rego, and Cedar) and claims <0.1ms p99 latency. Think of it as a system call interceptor for AI agents.
Agent Mesh provides cryptographic identity using decentralized identifiers (DIDs) with Ed25519 signatures. The Inter-Agent Trust Protocol (IATP) handles secure agent-to-agent communication. Dynamic trust scoring runs on a 0–1000 scale with five behavioral tiers — trust is earned and decays, not assigned once and forgotten.
Agent Runtime implements execution rings inspired by CPU privilege levels. Higher-privilege operations require approval from higher rings. A kill switch provides emergency agent termination. Saga orchestration handles multi-step transactions with rollback.
Agent SRE brings production reliability practices to agent systems: SLOs, error budgets, circuit breakers, chaos engineering, and progressive delivery. This is the package that addresses ASI08 (Cascading Failures) — something neither Google nor AWS directly tackle.
Agent Compliance automates governance verification with compliance grading and regulatory framework mapping for the EU AI Act, HIPAA, SOC2, and the full OWASP Agentic Top 10.
Agent Marketplace handles plugin lifecycle management with Ed25519 signing, verification, trust-tiered capability gating, and supply-chain security — the direct answer to ASI04.
Agent Lightning governs reinforcement learning training with policy-enforced runners and reward shaping, ensuring zero policy violations during RL training.
What makes it different
Three things stand out about Microsoft’s approach:
It’s actually open source. MIT-licensed, 9,500+ tests, SLSA-compatible build provenance, OpenSSF Scorecard tracking, ClusterFuzzLite fuzzing. Microsoft aspires to move it into a foundation. No other provider offers this.
It claims 10/10 OWASP coverage. Every risk in the Agentic Top 10 has a dedicated mitigation mechanism. Google and AWS address many of the same risks indirectly through platform services, but Microsoft has a specific package component for each one.
It’s framework-agnostic. The toolkit hooks into LangChain’s callback handlers, CrewAI’s task decorators, Google ADK’s plugin system, and Microsoft Agent Framework’s middleware pipeline. It works on any cloud. Dify has it in its marketplace. LlamaIndex, OpenAI Agents SDK, Haystack, LangGraph, and PydanticAI all have working integrations.
The risk
Open source means no managed SLA. Teams have to operate the governance infrastructure themselves. There’s no Google-style Agent Gateway routing all traffic automatically — you wire it into your agent code. For teams without dedicated platform engineering, this is a real adoption barrier.
Google Cloud: Identity-First Zero Trust for Agents
Announced: Google Cloud Next ’26, May 2026 | Platform: Google Cloud services
Google’s bet is that identity is the foundation. If you can cryptographically attest who an agent is — not what it claims to be, not what service account it borrowed, but its verified, first-class identity — then authorization, monitoring, and compliance all follow naturally.
Agent Identity: A new principal type
AI agents on Google Cloud can now receive a dedicated Agent Identity — a first-class principal type distinct from human identities or generic service accounts. Built on the SPIFFE (Secure Production Identity Framework For Everyone) standard, these identities are cryptographically protected, strongly attested, and automatically provisioned.
This is architecturally significant. Traditional IAM systems were designed for humans and service accounts. An agent that acts on behalf of a user, then autonomously, then delegates to another agent, doesn’t fit neatly into either category. Google’s answer is to create a new category.
The Agent Identity Auth Manager (in preview) streamlines complex OAuth flows for agents acting on behalf of users, handling credentials and tokens securely. Certificate Manager now supports Agent Identity certificates.
Agent Gateway: The enforcement chokepoint
All agent traffic on Google Cloud can now be routed through the Agent Gateway, a centralized enforcement point for all agent-to-agent and agent-to-tool connections. This is the architectural linchpin — it’s where policy decisions happen.
Identity-Aware Proxy (IAP) for Agents integrates with Agent Gateway to enforce granular access control policies using IAM, based on agent identities and contextual attributes from the Model Context Protocol (MCP). Context-Aware Access (CAA) evaluates device health, IP address, and location for agent identities before granting access.
Agent Access Management
Google has extended its existing IAM infrastructure to support agent-specific policies:
- IAM Allow and Deny policies for Agent Identity (GA)
- Principal Access Boundary (PAB) — sets hard limits on resources an agent can never access, regardless of inherited permissions (preview)
- Unified Access Policy (UAP) — granular control over agent access to tools, APIs, and resources; can mandate human-in-the-loop approvals for sensitive actions (coming soon)
Runtime Defense: Model Armor
Model Armor provides real-time protection for user, model, and agent interactions against prompt injection, tool poisoning, and sensitive data leakage. It now provides inline protection for Agent Gateway, Agent Runtime, and Google Cloud MCP servers.
This is where Google’s approach diverges from Microsoft’s. Model Armor is a probabilistic, AI-powered defense layer — it uses models to detect attacks. Microsoft’s Agent OS is purely deterministic. Google layers both deterministic controls (IAM, PAB, VPC-SC) and probabilistic controls (Model Armor) for defense in depth.
Agent Security Dashboard
New in preview: agentless discovery, vulnerability scanning, runtime threat detection, and graph-based risk discovery. Includes shadow AI agent detection — identifying unauthorized agents running in your organization.
The Google research paper
Google published “An Introduction to Google’s Approach for Secure AI Agents” outlining three core principles:
- Agents must have well-defined human controllers
- Their powers must be carefully limited
- Their actions and planning must be observable
They advocate a hybrid strategy combining deterministic security controls with dynamic, reasoning-based defenses. This is philosophically aligned with Microsoft’s approach but implemented as managed platform services rather than open-source packages.
The risk
Everything is Google Cloud only. If you’re running agents on AWS, on-premise, or across multiple clouds, Google’s governance story doesn’t extend to those environments. There’s also less published detail on inter-agent trust scoring and cascading failure prevention compared to Microsoft’s toolkit.
AWS Bedrock AgentCore: Deterministic Policy Outside the LLM
Announced: AWS re:Invent 2025 (December) | Platform: Amazon Bedrock
AWS was first to market with a production agent governance layer. Their approach is the most architecturally conservative — and the most auditor-friendly.
The “Agent Box” mental model
AWS frames the problem simply: isolate the agent from the outside world. Put walls around it that define what it can access, what it can interact with, and what effects it can have. Without a well-defined wall, an agent that can send emails, query databases, execute code, or trigger financial transactions is a liability.
Cedar: The policy language
AgentCore Policy uses Cedar, an authorization language designed to be both machine-efficient and human-auditable. Each policy specifies a principal (who), action (what), and resource (where), with conditions in a when clause:
permit(
principal == Agent::"appointment-scheduler",
action == Action::"view-patient-record",
resource in PatientRecords::"clinic-42"
) when { context.readOnly == true };Cedar’s semantics are deliberately boring: default deny, forbid wins over permit, order-independent evaluation, no side effects, no loops. Policies can be safely evaluated without sandboxing, even when written by untrusted authors. This is exactly what you want when the alternative is hoping a prompt injection doesn’t convince the agent to delete production data.
Natural language to Cedar
The most interesting feature: you can describe business rules in natural language and AgentCore formalizes them into Cedar policies. “This agent cannot delete objects in the production S3 bucket” becomes a machine-enforceable policy. For compliance teams, this is the difference between reading application code and reading auditable policy definitions.
AgentCore Gateway
All agent-to-tool traffic routes through the Gateway, which intercepts and evaluates every request against Cedar policies before the tool invocation executes. This enforcement is deterministic — it doesn’t matter how the agent is prompted, manipulated, or what bugs exist in the agent code. The Gateway enforces the policy regardless.
AgentCore Evaluations
13 pre-built evaluators covering correctness, helpfulness, safety, and more, running continuously against real agent interactions. Alerting on behavior regression. Metric tracking over time. This shifts agent oversight from manual spot-checks to a DevOps lifecycle.
AgentCore Memory
Episodic memory enables agents to remember what they’ve done, what failed, and what outcomes occurred across extended timeframes. This transforms agents from “smart tools you invoke” into “reliable workers who handle processes.”
The risk
AWS’s story is strongest for teams already in the Bedrock ecosystem. If you’re building agents with LangChain on your own infrastructure, AgentCore’s governance doesn’t automatically extend to those deployments. Cedar is open source, but the managed enforcement layer is AWS-only. The OWASP coverage is strong for tool misuse (ASI02) and identity (ASI03) but less explicit about memory poisoning (ASI06), cascading failures (ASI08), and rogue agents (ASI10).
Head-to-Head Comparison
Architecture
| Dimension | Microsoft AGT | Google Cloud | AWS AgentCore |
|---|---|---|---|
| Metaphor | Operating system kernel | Zero Trust network | Walled garden / sandbox |
| Core mechanism | Policy engine (Agent OS) | Agent Identity (SPIFFE) | Policy language (Cedar) |
| Deployment | Self-hosted, any cloud | Google Cloud only | AWS only |
| Open source | Yes (MIT) | No | Cedar is open; platform is not |
| Multi-cloud | Yes | No | No |
| Policy languages | YAML, OPA Rego, Cedar | IAM policies, VPC-SC rules | Cedar |
| Enforcement latency | <0.1ms p99 (published) | Not published | Not published (described as minimal) |
Identity and Trust
| Dimension | Microsoft AGT | Google Cloud | AWS AgentCore |
|---|---|---|---|
| Identity model | DIDs + Ed25519 | SPIFFE-based Agent Identity | IAM roles + Cedar principals |
| Trust scoring | 0–1000 scale, 5 tiers, behavioral decay | CAA contextual signals | Not published |
| Inter-agent trust | IATP protocol | Agent Gateway + IAP | AgentCore Gateway |
| Credential lifecycle | Short-lived, per-task | Agent Identity Auth Manager | Short-lived, per-task |
OWASP Agentic Top 10 Coverage
| OWASP Risk | Microsoft AGT | Google Cloud | AWS AgentCore |
|---|---|---|---|
| ASI01: Goal Hijack | Direct — semantic intent classifier | Partial — Model Armor PI detection | Partial — Guardrails PI detection |
| ASI02: Tool Misuse | Direct — capability sandboxing + MCP gateway | Partial — IAP + access policies | Direct — Cedar enforcement at gateway |
| ASI03: Identity Abuse | Direct — DID + trust scoring | Direct — Agent Identity + PAB + UAP | Partial — IAM + Cedar principals |
| ASI04: Supply Chain | Direct — Ed25519 plugin signing | Partial — vulnerability scanning | Not directly addressed |
| ASI05: Code Execution | Direct — execution rings | Partial — VPC-SC perimeter controls | Partial — agent box concept |
| ASI06: Memory Poisoning | Direct — CMVK majority voting | Not directly addressed | Not directly addressed |
| ASI07: Insecure Comms | Direct — IATP encryption | Partial — Agent Gateway routing | Partial — Gateway (encrypted) |
| ASI08: Cascading Failures | Direct — circuit breakers + SLOs | Not directly addressed | Not directly addressed |
| ASI09: Human-Agent Trust | Direct — quorum approval workflows | Partial — UAP HITL mandates (coming) | Not directly addressed |
| ASI10: Rogue Agents | Direct — ring isolation + kill switch | Partial — Agent Security dashboard | Not directly addressed |
Microsoft claims 10/10. Google and AWS address 3–4 risks directly and another 3–4 indirectly through platform services. The remaining gaps — memory poisoning, cascading failures, human-agent trust, and rogue agents — are the hardest problems in the space and nobody has fully solved them.
The Convergence: What Everyone Agrees On
Despite different architectures, all three platforms converge on the same principles:
1. Deterministic enforcement outside the LLM. None of them trust the model to enforce its own guardrails. Policies are evaluated by infrastructure, not by reasoning. This is non-negotiable for production deployments.
2. Agent identity is a first-class concept. Agents can’t keep borrowing human credentials or service accounts. Whether it’s DIDs (Microsoft), SPIFFE (Google), or IAM principals (AWS), agents need their own identities with their own permission boundaries.
3. Gateway architecture. All three route agent traffic through an enforcement chokepoint — Agent OS, Agent Gateway, or AgentCore Gateway. The policy decision happens before the action executes, not after.
4. Least agency. OWASP’s concept has been universally adopted. Give agents the minimum permissions needed. Require human approval for high-impact actions. Don’t deploy autonomy where it isn’t needed.
5. Observability is table stakes. You can’t govern what you can’t see. All three provide logging, monitoring, and alerting for agent behavior.
The Gaps Nobody Has Fully Solved
Even the most comprehensive toolkit has open questions:
Memory poisoning (ASI06) is nascent. Microsoft’s Cross-Model Verification Kernel with majority voting is novel but unproven at scale. Google and AWS don’t directly address it.
Cascading failure prevention (ASI08) in multi-agent systems is largely theoretical. Microsoft’s circuit breakers and SLOs borrow from the microservices playbook, but agent systems have fundamentally different failure modes — an agent that hallucinates isn’t the same as a service that returns 500.
Human-agent trust exploitation (ASI09) is the hardest problem. It’s social engineering, mediated through AI. No policy engine can fully solve the problem of a user trusting an agent’s output when they shouldn’t.
Rogue agent detection (ASI10) requires sophisticated behavioral monitoring. Microsoft’s trust scoring with decay is the most developed approach, but detecting an agent that’s subtly drifting from its intended behavior — without generating false positives on normal variation — is an open research problem.
Decision Framework
| If you… | Choose… | Why |
|---|---|---|
| Need multi-cloud or vendor-neutral governance | Microsoft AGT | Open source, works anywhere, any framework |
| Are all-in on Google Cloud | Google Cloud Agent Security | Deeply integrated, identity-first, managed service |
| Are all-in on AWS | Bedrock AgentCore | Cedar policies, managed service, auditor-friendly |
| Need the broadest OWASP coverage today | Microsoft AGT | Only toolkit claiming 10/10 with dedicated mechanisms |
| Need the fastest path to production | AWS AgentCore | GA since Dec 2025, managed service, least operational overhead |
| Want to contribute to open standards | Microsoft AGT + OWASP | MIT-licensed, foundation aspiration, active OWASP collaboration |
| Have strong platform engineering capacity | Microsoft AGT | Self-operated but maximum flexibility and coverage |
| Have limited platform engineering capacity | AWS or Google managed services | Less flexibility but less operational burden |
What to do this week
If you’re deploying agents in production: Map your highest-priority OWASP risks. Pick the platform that directly addresses them. Demand deterministic enforcement — probabilistic guardrails are insufficient for regulated environments.
If you’re in a regulated industry: Start with the OWASP Agentic Top 10 as your threat model. Document how your chosen platform addresses each risk. The EU AI Act deadline is August 2026 — that’s seven weeks from now.
If you’re evaluating: Install Microsoft’s toolkit (pip install agent-governance-toolkit[full]), spin up an AgentCore Gateway on AWS, and enable Agent Identity on Google Cloud. The fastest way to understand the differences is to run them against your actual agent workload.
The era of “trust the prompt” as a governance strategy is over. The infrastructure to enforce real boundaries around autonomous agents now exists. The question isn’t whether to adopt it — it’s which philosophy fits your architecture.
Research notes and full OWASP Top 10 analysis saved to the Obsidian vault. Sources: Microsoft Open Source Blog (April 2026), Google Cloud Blog (May 2026), AWS ML Blog (March 2026), OWASP GenAI Security Project (December 2025), Google Research (2025).