Microsoft Launches Agent Control Specification to Govern AI Agent Behavior

Agent control is fragmented across system prompts, code, and classifiers today

Developers improvise with system prompts, custom code checks, and classifiers — creating siloed, hard-to-audit controls that don't reuse across frameworks, interfaces, or environments. ACS aims to consolidate these into a single common governance layer.

ACS defines four workflow interception points for policy enforcement

Policies are checked before input is received, before a tool is called, after a tool returns a result, and before the final response is sent — covering the full agent decision lifecycle at every critical juncture.

Policies can allow, block, redact sensitive data, or escalate to human approval

Developers can also embed classifiers for I/O categorization, LLM-as-judge components for policy evaluation, and logic for validating tool calls, tool selection, input accuracy, and output usage.

Policy files are portable single files that bundle with agents across runtimes

A security policy written once travels with the agent across LangChain, AutoGen, CrewAI, and other runtimes without rewriting — enabling consistent governance in heterogeneous multi-framework deployments.

Open-source release positions Microsoft as agent governance standard-setter

At a moment when tool misuse and cascading agent failures are growing enterprise concerns, Microsoft's cross-framework SDK approach stakes out the governance layer and invites the industry to converge on ACS as a common standard.