Microsoft’s Agent Governance Toolkit (AGT) is the most direct open-source comparison to Olivares AI, and the honest summary is that it is genuinely strong where much of this category is not. Read its documentation directly rather than trusting anyone’s characterisation of it — including ours.
Sourcing. Every claim about AGT below links to Microsoft’s own repository and quotes it, with the date we read it. Where AGT’s documentation does not cover an axis, the cell says so instead of guessing. Nothing here comes from a blog post, an analyst note, or our own testing of their product.
AGT describes itself as “Policy enforcement, identity, sandboxing, and SRE for
autonomous AI agents. One pip install, any framework”
(README,
read 2026-07-19). It is MIT-licensed, in Public Preview, and ships a Claude Code
plugin alongside SDKs for Python, TypeScript, .NET, Rust and Go.
Where AGT is strong
Its enforcement is not advisory. A host “acts as the policy enforcement point and calls ACS at defined intervention points”, and “every tool call, message send, and delegation is intercepted in deterministic application code before the model’s intent reaches the wire” (policy-engine, README, read 2026-07-19).
Its audit trail is tamper-evident by construction: “The Merkle Audit Chain provides tamper-evident audit logging. Any modification to a historical audit entry MUST be detectable through hash verification” (AUDIT-COMPLIANCE-1.0, read 2026-07-19).
And it is not cloud-bound: “You can run AGT on AWS, GCP, on-premises, or air-gapped environments” (LIMITATIONS, read 2026-07-19).
If your problem is “stop this agent process from doing the wrong thing, and prove what it did”, AGT addresses it under a permissive licence, and you should evaluate it.
The structural divergence
| Dimension | Microsoft AGT | Olivares AI |
|---|---|---|
| Enforcement point | In-process: the host calls ACS as policy decision point at defined intervention points, before the call reaches the wire (policy-engine, 2026-07-19) | In-process PEP at agent runtimes and at the infrastructure data plane — databases, object stores, MCP servers, hosts |
| Permitted vs observed | — not documented. AGT documents discovered-agents-versus-registry reconciliation; a comparison of granted permissions against observed access is not in its docs (read 2026-07-19) | The read/write access map: what each agent is permitted, against what it actually reached |
| Audit evidence | Merkle hash-linked chain, tamper-evident, with inclusion proofs (AUDIT-COMPLIANCE-1.0, 2026-07-19). Off-box signed export not documented | Append-only, hash-chained, signed ledger, verifiable off-box |
| Estate kill switch | — not documented. Per-agent emergency termination and a budget-threshold kill switch are documented; a single estate-wide stop is not (read 2026-07-19) | Estate-wide kill switch |
| Deployment | Self-hosted, on-premises or air-gapped (LIMITATIONS, 2026-07-19) | Self-hosted control plane — Linux, Docker, Kubernetes, air-gapped |
| Licence | MIT (README, 2026-07-19) | AGPL-3.0 (open-core) |
| Maturity | Public Preview; latest release v4.1.0, 2026-06-09 (README, 2026-07-19) | Pre-1.0 — see honesty and limits |
The divergence is scope, not philosophy. AGT governs the agent process and the frameworks it adapts to. Olivares governs the estate an agent reaches into, which is where “permitted versus observed” and an estate-wide stop become answerable questions.
When AGT is the right choice
- You want MIT-licensed governance with no copyleft obligation.
- Your governance boundary is the agent runtime — you need the process stopped before it acts, and a tamper-evident record of what it attempted.
- You are standardising on the frameworks AGT adapts to and want one library rather than a separate control plane to operate.
When Olivares is the right choice
- You need to answer what an agent actually reached, not only what it attempted through a governed framework — the permitted-versus-observed gap.
- You need an estate-wide stop, not per-agent termination.
- You need the evidence verifiable off-box with signed assertions.
- Your agents reach infrastructure directly — databases, object stores, MCP servers, hosts — and that is where the boundary has to sit.
What we are not claiming
We have not run AGT in a lab and we publish no benchmark against it. The two axes marked “not documented” are statements about Microsoft’s public documentation as read on 2026-07-19, not claims that the capability is absent from their product. If AGT documents either axis later, this page is wrong and we will correct it.