Policy code can stop an action before the model reaches a tool
The toolkit's central idea is sound: prompts should not be the only place where an agent learns what it may do. A wrapper evaluates a policy before a tool call, records the decision, and can deny the call or require approval. The README shows a YAML rule blocking destructive database actions and another routing email sends to a security team.
That boundary matters when an agent can reach a database, shell, browser, or message service. It also creates a new responsibility. The wrapper must sit on every execution path, receive trustworthy identity and action data, and fail safely when policy or audit services are unavailable. One missed path can make 42 CI workflows and a detailed policy file irrelevant to the action that escaped them.
Public Preview covers many packages with unequal depth
Microsoft labels the project Public Preview and says breaking changes may arrive before general availability. The repository includes policy, mesh, runtime, SRE, compliance, marketplace, training, and hypervisor packages. It also lists an MCP security gateway, discovery tools, a dashboard, and integrations for many agent frameworks. Breadth is useful for evaluation and dangerous as a shortcut to assuming every surface is equally finished.
The README publishes packages for Python, TypeScript, .NET, Rust, and Go. Python has the full stack; the other SDKs implement a narrower core. Release v4.1.0 consolidated 45 prior Python packages into 5 top-level distributions and left old names as redirecting stubs. That cleanup helps installation, but upgrades still need import, policy, and behavior tests because older rule models were removed.
What happened when we ran it
Our sandbox tested commit b570558 in a Node 22 Debian container with 3 CPUs and 8 GB of RAM. The measured project lives under agent-governance-antigravity-cli/, so these results do not certify the Python core, every SDK, or every framework adapter. npm installed 7 packages in 9 seconds and used 7 MB on disk.
The subproject built in 8 seconds. Its node:test command finished in 7 seconds with 22 passed and 0 failed out of 22. npm audit reported 2 known vulnerabilities, both high severity, with 0 critical, moderate, or low findings. Before deployment, identify the affected dependencies and whether the execution path reaches them rather than dismissing or exaggerating the audit result.
The full checkout measured 49.1 MB, 4,787 files, and about 709,588 lines of source. Our scan saw 42 CI workflow files and a tests directory but no Dockerfile. We did not configure a policy service, run a governed agent, test a denial against an external tool, verify audit persistence, or exercise approval and recovery during a backend failure.
Windows Claude Code can report enforcement while hooks never run
Issue 3831 is the most important adoption warning we found. The reporter says the Claude Code plugin on Windows showed enforce mode and a healthy prompt-defense grade, while its session, prompt, and pre-tool hooks never executed. No audit log appeared. The reported cause is an extensionless shell launcher that Windows could not execute through the hook's spawn path.
The issue includes a direct node invocation as a tested fix, but an open report is not a released guarantee. Windows users should create a harmless denied tool, invoke it through the real Claude Code session, and verify both the denial and a new audit entry. A status page cannot substitute for that 2-part end-to-end check because this failure left status looking healthy.
Signed records prove integrity only within their trust model
Audit chains and signed receipts can show that a record was not changed after signing. They do not automatically show that an independent authority approved the action. Issue 3805 points out that the proposal and reference code may allow the acting agent's own process to hold the signing key. Such a receipt can be internally consistent while remaining self-attested.
For regulated or high-impact work, document who controls each signing key, which process may request signatures, how policy versions bind to decisions, and where logs are stored. Test deletion, clock errors, unavailable storage, and key rotation. The repository's 22 passing CLI tests say nothing about that deployed chain of custody, because our run did not create one.
Rust support is useful but not production parity yet
Issue 3680 is an umbrella proposal for Rust production parity. It names missing or incomplete workflow enforcement, durable state, observability, concrete framework integrations, and reproducible performance baselines. That is unusually candid scope information. Rust users should read it as a current boundary, not as a promise with a delivery date.
Open Policy Agent is a better fit when a company already has a policy service and only needs agents to submit decision inputs. Cedar is smaller when the problem is authorization rather than agent identity, SRE, and compliance tooling. Microsoft's toolkit earns a trial when those agent-specific layers would otherwise be built separately. The trial passes only when a denied action stays denied on each real framework, language, and operating system.