Skip to content

Microsoft AGT Interoperability

Jump to bottom
Fabrizio Degni edited this page Aug 8, 2026 · 4 revisions

Microsoft AGT Interoperability

Status

PALO-maintained community interoperability proposal for evaluation.

The optional adapter has been tested against Microsoft Agent Governance Toolkit Agent Control Specification (ACS) 0.3.1-beta.0 at upstream commit 81955d48025c6b11deb3fc9dabf89f74f4145775.

It is not maintained, certified, sponsored, or endorsed by Microsoft, and Microsoft AGT does not depend on PALO.

The interoperability boundary is currently open for maintainer and practitioner evaluation in Microsoft AGT Discussion #3647.

Architecture infographic

PALO and Microsoft AGT interoperability workflow and responsibility boundary

The visual summarizes the vendor-neutral handoff, the ACS pre_tool_call decision boundary, and the PALO-controlled execution, receipt, post-state verification, and incident workflow.

Complementary responsibility boundary

Microsoft AGT ACS acts as a replaceable pre-action policy provider. PALO retains its vendor-neutral governance and outcome-assurance lifecycle.

Lifecycle stage PALO responsibility Microsoft AGT responsibility Control lead
Claim and authority Own the immutable Action Claim and authority context Receive a normalized ACS snapshot PALO
Pre-action policy Call the selected provider and fail closed Evaluate ACS pre_tool_call policy AGT
Verdict handoff Normalize decision, reasons, and obligations Return allow, deny, warn, or escalate plus evidence references Shared boundary
Execution Issue one-time capability and use the governed executor Outside the mapped pre_tool_call scope PALO
Outcome assurance Record receipt, read authoritative state, manage incident workflow Verdict is retained but is not treated as outcome proof PALO

Technical flow

PALO Action Claim + Authority Profile
                 |
                 v
Vendor-neutral EnforcementProvider contract
                 |
                 +--> Microsoft AGT ACS pre_tool_call
                 |       allow / deny / warn / escalate
                 |
                 +--> OPA or another compatible provider
                 |
                 v
PALO one-time capability -> trusted executor -> signed receipt
                 |
                 v
Authoritative post-state verifier -> verified / mismatch / inconclusive
                 |
                 v
PALO Case File evidence + incident hold

AGT decides whether the proposed action may proceed under its runtime policy. PALO independently determines whether the digest-bound, approved effect actually occurred.

Deliberate fail-closed behavior

  • AGT deny and runtime errors map to PALO denied.
  • AGT escalate maps to pending_approval.
  • AGT warn maps to allowed with a review obligation.
  • AGT transform is not applied in place. Transformed arguments must be submitted as a new PALO Action Claim so they cannot bypass the approved digest.

Resources

PALO Framework

Clone this wiki locally