Microsoft Agent Governance Toolkit integration

Use the integration skill

Copy this skill link into your code agent to add Microsoft Agent Governance Toolkit and Contro1 to your system.

Copy skill link

Key takeaways

• Policy engines decide when approval is required. Contro1 runs the approval path.
• Send policy_context so the approval record preserves the Microsoft AGT policy source, rule, reason, version, and enforcement mode.
• High and critical risk approvals require a reviewer comment, and approval_comment_required can force comments on any request.
• Production approvals must use Contro1 APIs and signed webhooks.

Where each system sits

Microsoft Agent Governance Toolkit evaluates policy before a tool or action runs. Contro1 receives the approval request when that policy decision requires a human.

Use Microsoft AGT for policy enforcement. Use Contro1 for human approval routing, signed callbacks, and audit evidence.

Bridge flow

• The agent proposes a tool call.
• Microsoft AGT evaluates policy and returns allow, deny, or require_approval.
• For require_approval, the bridge creates a Contro1 request with policy_context.
• Contro1 routes the request, enforces comment rules, tracks SLA/escalation, and stores evidence.
• The runtime verifies the signed Contro1 callback and resumes only on approved status.

Request payload

{
  "title": "Approve governed tool call: send_email",
  "request_type": "approval",
  "source": {
    "integration": "microsoft-agent-governance-toolkit",
    "framework": "microsoft-agt",
    "workflow_id": "customer-outreach",
    "run_id": "run_123"
  },
  "context": {
    "tool_name": "send_email",
    "action_type": "external_send",
    "resource": "customer:c_8821",
    "environment": "production",
    "summary": "Send account update email to customer c_8821"
  },
  "continuation": {
    "mode": "decision",
    "webhook_url": "https://your-app.example.com/webhooks/contro1"
  },
  "risk_level": "high",
  "policy_trigger": "Outbound customer email requires human approval",
  "policy_context": {
    "source": "microsoft_agt",
    "policy_name": "production-policy",
    "rule_id": "require-approval-for-send-email",
    "rule_reason": "Outbound customer email requires human approval",
    "policy_version": "2026-05-28",
    "enforcement": "require_approval"
  },
  "approval_comment_required": true,
  "external_request_id": "agt:run_123:send_email",
  "correlation_id": "case_customer_outreach_123"
}

Policy context fields

Webhook handling

Callbacks include policy_context alongside risk_level, policy_trigger, decision_context, status, response, and protocol_response. Verify X-CentCom-Signature and X-CentCom-Timestamp before doing anything with the result.

Resume only when status is approved. Denied, cancelled, timed_out, invalid signatures, and duplicate callback delivery IDs should fail closed.

Webhooks · Requests API · Audit records and cases

Send full agent traceability

Beyond the approval call, attach identity, a run trace, the tools you invoked, and the context you retrieved. Each field is optional — add what you have. The verified identity always comes from your API key; a caller-supplied actor.agent_id is recorded as a claimed sub-agent until an admin verifies it.

• trace_id / parent_trace_id — link one run (and sub-agent runs) into a single trace.
• tool_calls[] — what the agent tried to do, so reviewers see the actions.
• retrieved_context[] — the data the decision was based on (RAG provenance).
• Then export a signed evidence packet from GET /requests/:id/evidence.

// POST /api/centcom/v1/requests — add these fields to the body you already send.
{
  "request_type": "approval",
  "title": "Refund $4,200 to customer 8831",
  "source": { "integration": "microsoft-agt" },
  "actor": { "agent_id": "billing-agent", "agent_name": "Billing Agent" },
  "trace_id": "trc_<run id>",
  "tool_calls": [{ "name": "lookup_order", "outcome": "success" }],
  "retrieved_context": [{ "source": "policy:refunds", "uri": "kb://policy/refunds" }],
  "continuation": { "mode": "decision" }
}

Agent identity, traceability & signed evidence

Make the approval the gate, not a suggestion

The signed webhook is cryptographic proof of a human decision. Verify it inside the system that executes the action - not inside the agent. Any tool that must never run without human sign-off (payments, deploys, data deletion) should refuse to act without a verified approval; that way no agent, including shadow agents nobody registered, can trigger it by skipping Contro1.

• Verify the signature and reject timestamps older than 5 minutes (replay protection; the timestamp marks callback delivery, not request creation, so long SLAs are unaffected).
• Bind the approval to the exact action parameters via metadata / correlation_id - never treat "an approval arrived" as permission for a different action.
• Execute each request_id exactly once (idempotency on your side).
• When in doubt, confirm state directly with GET /v1/requests/:id using a read-only API key.

Full guardrail pattern with code: Webhooks

Frequently asked questions

Does Contro1 replace Microsoft AGT?

No. Microsoft AGT remains the policy enforcement layer. Contro1 runs the human decision path once policy requires approval.

Is policy_context a policy engine?

No. policy_context is ingestion and evidence metadata. It records which external policy source, policy, and rule caused the review.