Proposal: PALO outcome-assurance interoperability with AGT ACS pre_tool_call

[Fabrizio Degni (sev7enITA)]

Summary

Hello, I have implemented a PALO-maintained interoperability adapter for the Microsoft Agent Governance Toolkit Agent Control Specification (ACS).

The objective is not to replace AGT or introduce a PALO dependency into AGT. The integration keeps AGT as the pre-action policy and enforcement system, while PALO adds downstream lifecycle accountability and independent outcome verification.

The current implementation is tested against agent-control-specification@0.3.1-beta.0, pinned to AGT upstream commit 81955d48025c6b11deb3fc9dabf89f74f4145775.

Interoperability workflow and trust boundary

Community interoperability proposal. Microsoft AGT remains responsible for ACS pre-action policy evaluation; PALO remains responsible for downstream authorization, execution evidence and independent outcome assurance. No Microsoft endorsement is implied.

Complementary boundaries

Stage	Responsibility
Action definition	PALO creates an immutable, digest-bound Action Claim and Effect Contract
Pre-action policy decision	AGT ACS evaluates the pre_tool_call snapshot
Decision mapping	The external adapter correlates AGT identity, verdict and evidence references with the PALO claim
Authorization	PALO issues a scoped, one-time execution capability after policy and approval requirements are satisfied
Execution	A trusted executor invokes the target tool or system
Evidence	The executor produces a signed receipt linked to the original claim
Outcome assurance	PALO independently reads authoritative business state and classifies the outcome as verified, mismatch or inconclusive
Incident handling	A mismatch can create an assurance incident and place the affected resource on hold

AGT therefore answers whether an action may proceed under runtime policy. PALO subsequently verifies whether the approved, digest-bound effect actually occurred.

The adapter is treated as external to the AGT trust boundary. AGT retains ownership of ACS evaluation, policy execution and AGT evidence integrity. PALO retains ownership of its Action Claims, capabilities, receipts, authoritative post-state verification and incident workflow.

Implemented behavior

The current adapter:

• maps the PALO claim, agent identity, tenant, case, resource, scope and approval evidence into an ACS pre_tool_call snapshot;
• maps AGT allow, warn, escalate and deny verdicts into the PALO lifecycle;
• fails closed on missing packages, manifest errors, runtime failures and unknown decisions;
• preserves AGT action identity and evidence references in the downstream PALO decision record;
• rejects an in-place ACS transform verdict and requires the transformed arguments to be submitted as a new PALO Action Claim, preventing mutation behind an already approved digest;
• introduces no mandatory Microsoft dependency into the PALO core.

The synthetic demonstration covers two paths:

1. allowed → executed → independently verified
2. allowed → executed with a different effect → mismatch → incident hold

Maintainer guidance requested

Before preparing an upstream pull request, we would appreciate guidance from the AGT maintainers.

Would you prefer this interoperability work to be presented as:

1. an independently maintained external reference;
2. a small documentation reference connected to the existing External Operation Accountability Profiles guidance;
3. a runnable example under the AGT examples/ tree; or
4. a reusable integration contribution following the AGT RFC process?

We are happy to follow the repository's preferred contribution route, CLA, DCO, testing and documentation requirements. No upstream dependency or core API change is being requested at this stage.

Implementation and evaluation material

• Version-pinned implementation and quickstart
• Microsoft AGT ACS provider adapter
• Technical proposal and contribution playbook
• Public evaluation overview
• PALO interoperability Wiki page
• AGT External Operation Accountability Profiles

This is a community interoperability proposal. It is not maintained, certified, sponsored or endorsed by Microsoft.

Feedback from @microsoft/agent-governance-team would be very welcome.

[Fabrizio Degni (sev7enITA)]

Publication update

The public P.A.L.O. evaluation page is now live and synchronized with the merged interoperability implementation:

https://paloframework.org/docs/community/palo-microsoft-agt-interoperability-proposal.html

It provides a more accessible overview of:

• the complementary PALO–AGT trust boundaries;
• the complete pre-action-to-outcome-assurance workflow;
• the version-pinned implementation and runnable quickstart;
• the validation and fail-closed behavior;
• the distinction between an AGT policy verdict and independently verified business outcome.

The implementation remains an optional, PALO-maintained community interoperability proposal external to the AGT trust boundary. It introduces no dependency or core API change into Microsoft AGT, and no Microsoft endorsement is implied.

I would still welcome maintainer guidance on the preferred upstream contribution route.

[Ali Pourrahim (Aliipou)]

Outcome-assurance interop (PALO) and a pre-tool PEP compose. We only claim the latter: bind, sign, spend, execute, audit. Happy to be a small complementary runtime, not a competing control plane.

Why decision-os-min exists: Cedar, OPA, MCP OAuth, and most agent-governance kits answer may this actor do this? Autonomous systems that act still need a signed, action-bound, one-time grant and a PEP that will not run the tool without it. Prompt rules do not preserve human ownership of the effect. Cedar/OPA stay replaceable PDPs; they cannot mint. The agent never holds the key. Not a Cedar competitor; not an AGI-safety proof.

https://github.com/Aliipou/decision-os-min/blob/main/docs/WHY.md
Aliipou/decision-os-min#2