Microsoft empowers devs with precise AI agent control.

As the capabilities of AI agents rapidly advance, organizations deploying them across a myriad of applications, workflows, and products are confronting a significant new hurdle: ensuring these agents consistently operate as intended across diverse operational environments.

Microsoft is addressing this critical issue with the introduction of a new open-source standard named Agent Control Specification, or ACS. This initiative aims to provide developers with a more consistent and granular framework for dictating the permissible actions of AI agents.

The specification empowers development, compliance, and security teams to establish bespoke policies for agents to adhere to. These rules can meticulously define what an agent is permitted or forbidden to do, when human approval for an action is necessary, and what evidence must be logged for subsequent auditing. These policy files are rigorously checked at various "interception points" throughout an agent's task execution, ensuring strict adherence to predefined guardrails.

This specification emerges at a time when developers are often resorting to improvised methods for controlling AI behavior, particularly amidst growing discussions concerning AI workflow failures attributed to tool misuse or unintended actions that trigger cascading problems.

Currently, developers might implement controls by embedding instructions in system prompts, integrating custom checks within application code, or employing classifiers to filter problematic inputs and outputs. While these methods offer some utility, they frequently result in fragmented control mechanisms that are challenging to audit and difficult to reuse across disparate frameworks, interfaces, and systems.

ACS is designed to unify these various controls into a cohesive governance layer. Microsoft highlights that the specification can verify an agent's compliance with guardrails at multiple stages of its workflow—specifically, before it processes input, prior to calling a tool, after a tool returns a result, and before the final response is delivered to the user. A policy can dictate whether an action is allowed, blocked, requires redaction of sensitive information, or even necessitates human approval.

Furthermore, developers can integrate classifiers for inputs and outputs to categorize information, predict outcomes, or determine appropriate agent responses. They can also incorporate Large Language Models (LLMs) with specific prompts to function as a "judge" for policy adherence, alongside custom logic for validating tool calls, tool selection, input accuracy, output utilization, and overall responses.

The ability to write these policies as single, self-contained files means they can be bundled directly with agents. This ensures that a defined security policy consistently accompanies an agent as it moves across different frameworks and operational environments.

ACS is being released as an SDK, complete with plugins supporting a wide array of platforms, including LangChain, the OpenAI Agents SDK, the Anthropic Agents SDK, AutoGen, CrewAI, Semantic Kernel, Microsoft.Extensions.AI, MCP tools, and many others.