# Agent Control Specification (ACS): Portable Runtime Policy Enforcement for Agents

> Microsoft's open, MIT-licensed specification for enforcing policy at defined checkpoints in an agent's execution loop — the eight intervention points, five verdict types, and how it differs from guardrail tooling and other agent-security specs already on ChangeGamer.

Category: Reference · Updated: 2026-07-17 · Tags: agent-governance, security, specification, policy-engine, guardrails, standards, open-source, runtime-enforcement
Canonical: https://changegamer.ai/resources/agent-control-specification
Variants: [HTML](https://changegamer.ai/resources/agent-control-specification) · [JSON](https://changegamer.ai/api/resources/agent-control-specification.json)
License: https://changegamer.ai/license.xml · Access: free

The Agent Control Specification (ACS) is Microsoft's open specification for enforcing policy at defined checkpoints inside an agent's own execution loop, independent of which framework runs the agent. It defines a stateless, deterministic contract: a host submits a full snapshot of the current step plus a policy manifest at each checkpoint, and the ACS runtime returns a normalized verdict the host is responsible for enforcing. ACS does not run the agent — it is a policy-decision contract that framework-specific adapters plug into.

## Key facts

- Announced June 2, 2026 at Microsoft Build 2026, alongside a separate evals component ("ASSERT," not covered on this page).
- Lives inside Microsoft's broader open-source **Agent Governance Toolkit** monorepo (github.com/microsoft/agent-governance-toolkit), confirmed MIT-licensed directly from the repository's own LICENSE file.
- Current spec text (`policy-engine/spec/SPECIFICATION.md`) is versioned **0.3.1-beta**, status **Draft** — expect breaking changes before a stable 1.0.
- Positioned as community-governed rather than vendor-locked: adapters ship for LangChain/LangGraph, the OpenAI Agents SDK (middleware), an Anthropic Messages-API adapter, AutoGen, CrewAI, Semantic Kernel (native), MCP tools, and .NET via the `Microsoft.AgentGovernance` package family (with MCP and Microsoft Agent Framework extensions).
- The wider toolkit claims coverage of all ten OWASP Agentic AI Top 10 risk categories (see /resources/agentic-security-checklist for that taxonomy) — a toolkit-level claim, not a property of the ACS spec text itself.

## Eight intervention points, five verdicts

The spec defines eight named checkpoints across an agent's lifecycle: `agent_startup`, `input` (external request ingress), `pre_model_call`, `post_model_call`, `pre_tool_call`, `post_tool_call`, `output` (final assembled response), and `agent_shutdown`. At each one, a policy dispatcher returns one of five verdicts: **allow** (unchanged), **warn** (permitted, logged), **transform** (permitted, target replaced per the manifest), **deny** (refused), or **escalate** (deferred to the host's approval workflow). The runtime "MUST NOT retain mutable state that influences a verdict from one evaluation to the next," and fails closed: any evaluation error yields `deny`. Policy logic can be expressed in Open Policy Agent (Rego) or Cedar via bundled dispatchers, or in a custom host-supplied adapter.

## How this differs from adjacent ChangeGamer resources

- **Not /resources/agent-guardrails**: that entry surveys guardrail *products* (classifiers, moderation APIs, prompt-injection detectors); ACS is a specification for how any of those tools plug into one portable, cross-framework checkpoint contract — it doesn't ship a detector of its own.
- **Not /resources/ai-control-for-agents**: DeepMind's roadmap is a threat-model paradigm (assume the agent itself may act harmfully) with Detection/Response maturity tiers; ACS is a concrete, implementable runtime-policy contract that could help satisfy that paradigm's requirements but doesn't define a threat model of its own.
- **Not /resources/mcp-server-authentication**: that covers how an agent authenticates to an *external* MCP server; ACS governs policy decisions inside the agent's own loop, regardless of which external services it calls.

## Verified sources

Primary (fetched directly this session):

- Specification text: https://raw.githubusercontent.com/microsoft/agent-governance-toolkit/main/policy-engine/spec/SPECIFICATION.md
- LICENSE file: https://raw.githubusercontent.com/microsoft/agent-governance-toolkit/main/LICENSE
- Repository page (description, package list, OWASP claim): https://github.com/microsoft/agent-governance-toolkit
- Releases page (v4.0.0, June 1, 2026; v4.1.0, June 9, 2026): https://github.com/microsoft/agent-governance-toolkit/releases

Secondary — WebSearch-corroborated (3+ independently agreeing outlets on the June 2, 2026 Build 2026 announcement date):

- TechCrunch, "Microsoft offers devs a better way to control AI agent behavior": https://techcrunch.com/2026/06/02/microsoft-offers-devs-a-better-way-to-control-ai-agent-behavior/
- Microsoft Security Blog, "Microsoft Build 2026: Securing code, agents, and models across the development lifecycle": https://www.microsoft.com/en-us/security/blog/2026/06/02/microsoft-build-2026-securing-code-agents-and-models-across-the-development-lifecycle/
- Enterprise DNA, "Microsoft Releases Open Standard to Govern AI Agents": https://enterprisedna.co/resources/news/microsoft-acs-agent-control-specification-enterprise-2026/

Note: some early secondary coverage described ACS as Apache-2.0 licensed; a direct fetch of the repository's own LICENSE file (above) confirms **MIT** — the repo is treated as authoritative over blog paraphrase here.

- See also: /resources/agent-guardrails, /resources/ai-control-for-agents, /resources/agentic-security-checklist, /resources/mcp-server-authentication

---

## Related resources

- [Guardrails and Safety Filters for Agents](https://changegamer.ai/resources/agent-guardrails.md): Runtime input/output/action controls that enforce policy independently of the model — tooling landscape, techniques, and layering guidance.
- [Prompt Injection Design Patterns: Architectural Defenses for Agents](https://changegamer.ai/resources/prompt-injection-design-patterns.md): Six named architectural patterns — Action-Selector, Plan-Then-Execute, LLM Map-Reduce, Dual LLM, Code-Then-Execute, Context-Minimization — plus Google DeepMind's CaMeL, that structurally constrain what an agent can do with untrusted data instead of just filtering it.
- [Agent Delegation Chains: Credential Propagation in Multi-Agent Systems](https://changegamer.ai/resources/agent-delegation-chains.md): How credential authority flows when one agent spawns another — the multi-hop delegation problem, RFC 8693 token exchange, the act/may_act claims, audience binding across hops, and the IETF drafts standardizing verifiable actor chains in 2026.
- [AI Supply Chain Provenance: SBOMs, SLSA, and Artifact Signing for Agents and MCP Servers](https://changegamer.ai/resources/ai-supply-chain-provenance.md): How CycloneDX AI/ML-BOM, SPDX AI profiles, SLSA build levels, and in-toto/Sigstore signing let an agent check what is actually inside a model, package, or MCP server — and how it was built — before trusting it.

---

Index of all resources: https://changegamer.ai/llms.txt · Full corpus: https://changegamer.ai/llms-full.txt · Corpus data (NDJSON): https://changegamer.ai/api/corpus.jsonl · Offers: https://changegamer.ai/api/pricing.json