Microsoft's AI Agents Now Have Rules. Here's Why That Took So Long.

Building an AI agent in 2025 takes an afternoon. Controlling what that agent does once it's running, that part has been nobody's problem. Until now. Microsoft just open-sourced the Agent Governance Toolkit, a middleware layer that sits between your AI agents and everything they can touch. Every tool call gets evaluated against a policy before it runs. No rewriting your existing agents. No switching frameworks. Just a security kernel dropped into whatever stack you're already using. This is not a flashy release. There's no demo video with a robot arm. But if you're building anything serious with agents, this is probably more important than the last three model releases you got excited about. How We Got Here In December 2025, OWASP published the first-ever risk list specifically for autonomous AI agents. Ten risks. All of them serious. Goal hijacking, tool misuse, memory poisoning, rogue agents, identity abuse, the list reads like a threat model for a system nobody had actually finished