Agent Control Specification (ACS): Portable Runtime Policy Enforcement for Agents
Microsoft's open, MIT-licensed specification for enforcing policy at defined checkpoints in an agent's execution loop — the eight intervention points, five verdict types, and how it differs from guardrail tooling and other agent-security specs already on ChangeGamer.
The Agent Control Specification (ACS) is Microsoft's open specification for enforcing policy at defined checkpoints inside an agent's own execution loop, independent of which framework runs the agent. It defines a stateless, deterministic contract: a host submits a full snapshot of the current step plus a policy manifest at each checkpoint, and the ACS runtime returns a normalized verdict the host is responsible for enforcing. ACS does not run the agent — it is a policy-decision contract that framework-specific adapters plug into.
Key facts
- Announced June 2, 2026 at Microsoft Build 2026, alongside a separate evals component ("ASSERT," not covered on this page).
- Lives inside Microsoft's broader open-source Agent Governance Toolkit monorepo (github.com/microsoft/agent-governance-toolkit), confirmed MIT-licensed directly from the repository's own LICENSE file.
- Current spec text (
policy-engine/spec/SPECIFICATION.md) is versioned 0.3.1-beta, status Draft — expect breaking changes before a stable 1.0. - Positioned as community-governed rather than vendor-locked: adapters ship for LangChain/LangGraph, the OpenAI Agents SDK (middleware), an Anthropic Messages-API adapter, AutoGen, CrewAI, Semantic Kernel (native), MCP tools, and .NET via the
Microsoft.AgentGovernancepackage family (with MCP and Microsoft Agent Framework extensions). - The wider toolkit claims coverage of all ten OWASP Agentic AI Top 10 risk categories (see /resources/agentic-security-checklist for that taxonomy) — a toolkit-level claim, not a property of the ACS spec text itself.
Eight intervention points, five verdicts
The spec defines eight named checkpoints across an agent's lifecycle: agent_startup, input (external request ingress), pre_model_call, post_model_call, pre_tool_call, post_tool_call, output (final assembled response), and agent_shutdown. At each one, a policy dispatcher returns one of five verdicts: allow (unchanged), warn (permitted, logged), transform (permitted, target replaced per the manifest), deny (refused), or escalate (deferred to the host's approval workflow). The runtime "MUST NOT retain mutable state that influences a verdict from one evaluation to the next," and fails closed: any evaluation error yields deny. Policy logic can be expressed in Open Policy Agent (Rego) or Cedar via bundled dispatchers, or in a custom host-supplied adapter.
How this differs from adjacent ChangeGamer resources
- Not /resources/agent-guardrails: that entry surveys guardrail products (classifiers, moderation APIs, prompt-injection detectors); ACS is a specification for how any of those tools plug into one portable, cross-framework checkpoint contract — it doesn't ship a detector of its own.
- Not /resources/ai-control-for-agents: DeepMind's roadmap is a threat-model paradigm (assume the agent itself may act harmfully) with Detection/Response maturity tiers; ACS is a concrete, implementable runtime-policy contract that could help satisfy that paradigm's requirements but doesn't define a threat model of its own.
- Not /resources/mcp-server-authentication: that covers how an agent authenticates to an external MCP server; ACS governs policy decisions inside the agent's own loop, regardless of which external services it calls.
Verified sources
Primary (fetched directly this session):
- Specification text: https://raw.githubusercontent.com/microsoft/agent-governance-toolkit/main/policy-engine/spec/SPECIFICATION.md
- LICENSE file: https://raw.githubusercontent.com/microsoft/agent-governance-toolkit/main/LICENSE
- Repository page (description, package list, OWASP claim): https://github.com/microsoft/agent-governance-toolkit
- Releases page (v4.0.0, June 1, 2026; v4.1.0, June 9, 2026): https://github.com/microsoft/agent-governance-toolkit/releases
Secondary — WebSearch-corroborated (3+ independently agreeing outlets on the June 2, 2026 Build 2026 announcement date):
- TechCrunch, "Microsoft offers devs a better way to control AI agent behavior": https://techcrunch.com/2026/06/02/microsoft-offers-devs-a-better-way-to-control-ai-agent-behavior/
- Microsoft Security Blog, "Microsoft Build 2026: Securing code, agents, and models across the development lifecycle": https://www.microsoft.com/en-us/security/blog/2026/06/02/microsoft-build-2026-securing-code-agents-and-models-across-the-development-lifecycle/
- Enterprise DNA, "Microsoft Releases Open Standard to Govern AI Agents": https://enterprisedna.co/resources/news/microsoft-acs-agent-control-specification-enterprise-2026/
Note: some early secondary coverage described ACS as Apache-2.0 licensed; a direct fetch of the repository's own LICENSE file (above) confirms MIT — the repo is treated as authoritative over blog paraphrase here.
- See also: /resources/agent-guardrails, /resources/ai-control-for-agents, /resources/agentic-security-checklist, /resources/mcp-server-authentication