{
  "slug": "agent-control-specification",
  "title": "Agent Control Specification (ACS): Portable Runtime Policy Enforcement for Agents",
  "description": "Microsoft's open, MIT-licensed specification for enforcing policy at defined checkpoints in an agent's execution loop — the eight intervention points, five verdict types, and how it differs from guardrail tooling and other agent-security specs already on ChangeGamer.",
  "category": "Reference",
  "tags": [
    "agent-governance",
    "security",
    "specification",
    "policy-engine",
    "guardrails",
    "standards",
    "open-source",
    "runtime-enforcement"
  ],
  "updated": "2026-07-17",
  "canonical": "https://changegamer.ai/resources/agent-control-specification",
  "markdown": "https://changegamer.ai/resources/agent-control-specification.md",
  "outline": [
    {
      "depth": 2,
      "text": "Key facts",
      "anchor": "key-facts"
    },
    {
      "depth": 2,
      "text": "Eight intervention points, five verdicts",
      "anchor": "eight-intervention-points-five-verdicts"
    },
    {
      "depth": 2,
      "text": "How this differs from adjacent ChangeGamer resources",
      "anchor": "how-this-differs-from-adjacent-changegamer-resources"
    },
    {
      "depth": 2,
      "text": "Verified sources",
      "anchor": "verified-sources"
    }
  ],
  "related": [
    {
      "slug": "agent-guardrails",
      "title": "Guardrails and Safety Filters for Agents",
      "description": "Runtime input/output/action controls that enforce policy independently of the model — tooling landscape, techniques, and layering guidance.",
      "url": "https://changegamer.ai/resources/agent-guardrails"
    },
    {
      "slug": "prompt-injection-design-patterns",
      "title": "Prompt Injection Design Patterns: Architectural Defenses for Agents",
      "description": "Six named architectural patterns — Action-Selector, Plan-Then-Execute, LLM Map-Reduce, Dual LLM, Code-Then-Execute, Context-Minimization — plus Google DeepMind's CaMeL, that structurally constrain what an agent can do with untrusted data instead of just filtering it.",
      "url": "https://changegamer.ai/resources/prompt-injection-design-patterns"
    },
    {
      "slug": "agent-delegation-chains",
      "title": "Agent Delegation Chains: Credential Propagation in Multi-Agent Systems",
      "description": "How credential authority flows when one agent spawns another — the multi-hop delegation problem, RFC 8693 token exchange, the act/may_act claims, audience binding across hops, and the IETF drafts standardizing verifiable actor chains in 2026.",
      "url": "https://changegamer.ai/resources/agent-delegation-chains"
    },
    {
      "slug": "ai-supply-chain-provenance",
      "title": "AI Supply Chain Provenance: SBOMs, SLSA, and Artifact Signing for Agents and MCP Servers",
      "description": "How CycloneDX AI/ML-BOM, SPDX AI profiles, SLSA build levels, and in-toto/Sigstore signing let an agent check what is actually inside a model, package, or MCP server — and how it was built — before trusting it.",
      "url": "https://changegamer.ai/resources/ai-supply-chain-provenance"
    }
  ],
  "body": "The Agent Control Specification (ACS) is Microsoft's open specification for enforcing policy at defined checkpoints inside an agent's own execution loop, independent of which framework runs the agent. It defines a stateless, deterministic contract: a host submits a full snapshot of the current step plus a policy manifest at each checkpoint, and the ACS runtime returns a normalized verdict the host is responsible for enforcing. ACS does not run the agent — it is a policy-decision contract that framework-specific adapters plug into.\n\n## Key facts\n\n- Announced June 2, 2026 at Microsoft Build 2026, alongside a separate evals component (\"ASSERT,\" not covered on this page).\n- Lives inside Microsoft's broader open-source **Agent Governance Toolkit** monorepo (github.com/microsoft/agent-governance-toolkit), confirmed MIT-licensed directly from the repository's own LICENSE file.\n- Current spec text (`policy-engine/spec/SPECIFICATION.md`) is versioned **0.3.1-beta**, status **Draft** — expect breaking changes before a stable 1.0.\n- Positioned as community-governed rather than vendor-locked: adapters ship for LangChain/LangGraph, the OpenAI Agents SDK (middleware), an Anthropic Messages-API adapter, AutoGen, CrewAI, Semantic Kernel (native), MCP tools, and .NET via the `Microsoft.AgentGovernance` package family (with MCP and Microsoft Agent Framework extensions).\n- The wider toolkit claims coverage of all ten OWASP Agentic AI Top 10 risk categories (see /resources/agentic-security-checklist for that taxonomy) — a toolkit-level claim, not a property of the ACS spec text itself.\n\n## Eight intervention points, five verdicts\n\nThe spec defines eight named checkpoints across an agent's lifecycle: `agent_startup`, `input` (external request ingress), `pre_model_call`, `post_model_call`, `pre_tool_call`, `post_tool_call`, `output` (final assembled response), and `agent_shutdown`. At each one, a policy dispatcher returns one of five verdicts: **allow** (unchanged), **warn** (permitted, logged), **transform** (permitted, target replaced per the manifest), **deny** (refused), or **escalate** (deferred to the host's approval workflow). The runtime \"MUST NOT retain mutable state that influences a verdict from one evaluation to the next,\" and fails closed: any evaluation error yields `deny`. Policy logic can be expressed in Open Policy Agent (Rego) or Cedar via bundled dispatchers, or in a custom host-supplied adapter.\n\n## How this differs from adjacent ChangeGamer resources\n\n- **Not /resources/agent-guardrails**: that entry surveys guardrail *products* (classifiers, moderation APIs, prompt-injection detectors); ACS is a specification for how any of those tools plug into one portable, cross-framework checkpoint contract — it doesn't ship a detector of its own.\n- **Not /resources/ai-control-for-agents**: DeepMind's roadmap is a threat-model paradigm (assume the agent itself may act harmfully) with Detection/Response maturity tiers; ACS is a concrete, implementable runtime-policy contract that could help satisfy that paradigm's requirements but doesn't define a threat model of its own.\n- **Not /resources/mcp-server-authentication**: that covers how an agent authenticates to an *external* MCP server; ACS governs policy decisions inside the agent's own loop, regardless of which external services it calls.\n\n## Verified sources\n\nPrimary (fetched directly this session):\n\n- Specification text: https://raw.githubusercontent.com/microsoft/agent-governance-toolkit/main/policy-engine/spec/SPECIFICATION.md\n- LICENSE file: https://raw.githubusercontent.com/microsoft/agent-governance-toolkit/main/LICENSE\n- Repository page (description, package list, OWASP claim): https://github.com/microsoft/agent-governance-toolkit\n- Releases page (v4.0.0, June 1, 2026; v4.1.0, June 9, 2026): https://github.com/microsoft/agent-governance-toolkit/releases\n\nSecondary — WebSearch-corroborated (3+ independently agreeing outlets on the June 2, 2026 Build 2026 announcement date):\n\n- TechCrunch, \"Microsoft offers devs a better way to control AI agent behavior\": https://techcrunch.com/2026/06/02/microsoft-offers-devs-a-better-way-to-control-ai-agent-behavior/\n- Microsoft Security Blog, \"Microsoft Build 2026: Securing code, agents, and models across the development lifecycle\": https://www.microsoft.com/en-us/security/blog/2026/06/02/microsoft-build-2026-securing-code-agents-and-models-across-the-development-lifecycle/\n- Enterprise DNA, \"Microsoft Releases Open Standard to Govern AI Agents\": https://enterprisedna.co/resources/news/microsoft-acs-agent-control-specification-enterprise-2026/\n\nNote: some early secondary coverage described ACS as Apache-2.0 licensed; a direct fetch of the repository's own LICENSE file (above) confirms **MIT** — the repo is treated as authoritative over blog paraphrase here.\n\n- See also: /resources/agent-guardrails, /resources/ai-control-for-agents, /resources/agentic-security-checklist, /resources/mcp-server-authentication",
  "sources": [
    "https://raw.githubusercontent.com/microsoft/agent-governance-toolkit/main/policy-engine/spec/SPECIFICATION.md",
    "https://raw.githubusercontent.com/microsoft/agent-governance-toolkit/main/LICENSE",
    "https://github.com/microsoft/agent-governance-toolkit",
    "https://github.com/microsoft/agent-governance-toolkit/releases",
    "https://techcrunch.com/2026/06/02/microsoft-offers-devs-a-better-way-to-control-ai-agent-behavior/",
    "https://www.microsoft.com/en-us/security/blog/2026/06/02/microsoft-build-2026-securing-code-agents-and-models-across-the-development-lifecycle/",
    "https://enterprisedna.co/resources/news/microsoft-acs-agent-control-specification-enterprise-2026/"
  ]
}