Microsoft's Agent Governance Toolkit (AGT) is a family of language SDKs you wrap around your own tool calls. Tenure is a protocol-level gateway your requests pass through. Same goal, enforcement, opposite architecture: inside the process versus outside it.
AGT governs by asking your code to cooperate. You import the SDK, wrap a tool function with govern(), and every call through that wrapper is checked against a YAML, OPA, or Cedar policy before it runs. It runs in whatever language your agent is already written in.
The tradeoff is where that control lives. The policy engine executes inside the same process as the agent it's governing. There is no separate trust boundary between the thing being checked and the thing doing the checking.
AGT's own documentation states: the policy engine and agents "share the same process boundary." Their stated production recommendation is to run each agent in a separate container for OS-level isolation, which is an infrastructure workaround applied on top of the toolkit, not a property the governance layer provides on its own.
Ask what happens when the thing being governed changes underneath the governance layer. In AGT's model, that happens in several places at once.
Per-framework adapters. AGT integrates with LangGraph, CrewAI, AutoGen, the OpenAI Agents SDK, and roughly a dozen others, each through its own adapter. When one of those frameworks changes how it dispatches tool calls internally, and agent frameworks change quickly, the adapter has to be updated to keep intercepting correctly. Until it is, calls either fail outright or pass through ungoverned.
Per-callsite wrapping. Enforcement only exists where a developer remembered to call govern(). A new tool added after the initial integration, or a raw call that reaches the underlying function directly, is simply not evaluated. There is no fallback checkpoint catching what the wrapper missed.
Cross-language parity. AGT publishes five SDKs and is explicit that the Python package carries the full feature set while the others carry partial coverage, tracked in a package-feature matrix. Five independent implementations of the same policy semantics is five places for behavior to quietly diverge as each one ships on its own schedule.
None of this requires an attacker. A minor version bump in a dependency, a framework release that changes its tool-call internals, or a developer who adds a tool and forgets the wrapper is enough to open a gap. Tenure doesn't have an equivalent surface to keep in sync, because it isn't watching library calls inside your process. It's watching the same OpenAI or Anthropic protocol request regardless of which framework, language, or SDK version produced it.
AGT ships formal compliance mapping for OWASP Agentic AI Top 10, NIST AI RMF, EU AI Act, and SOC 2, each with automated evidence generation. Tenure covers EU AI Act today.
If a team wants one toolkit that covers governance, compliance paperwork, and operational reliability in whatever language they already write in, and is willing to add container-level isolation themselves, AGT is a reasonable choice. Tenure's bet is narrower: a single out-of-process checkpoint that every request has to cross regardless of language, framework, or which developer remembered to wrap what.
| Property | Tenure | AGT |
|---|---|---|
| Enforcement location | On the wire | Same process as agent |
| Default policy action | Deny | Allow (published example) |
| Requires per-callsite wrapping | No | Yes (govern()) |
| Requires per-framework adapter | No, protocol-level | Yes, one per framework |
| Language SDKs to keep in sync | 0, single gateway | 5 (partial feature parity) |
| Survives a compromised agent dependency | Yes, separate trust boundary | Not by default, shared process |
| Precondition evidence checks (field/type/value) | Yes | Not part of published spec |
| Compliance mapping (OWASP/NIST/SOC2/EU AI Act) | EU AI Act only | All four, automated evidence |
| Requires an SDK integration | No, any OpenAI/Anthropic client | Yes, per language |
| Self-hosted | Yes, always | Yes, runs in your own process |
| License | MIT | MIT |
This comparison is based on AGT's public documentation and README as published at github.com/microsoft/agent-governance-toolkit. Details are current as of AGT's public preview release; verify against the latest docs before citing specific figures.
No SDK. No per-framework adapter. No callsite to forget. One protocol-level checkpoint every request crosses.