The Production Governance Gap Is Costing Teams

Most teams shipping AI agents in 2026 have a governance document. Almost none have governance that actually runs at runtime. The gap is not philosophical — it is operational. Policies written in Word files do not intercept a misbehaving tool call. They do not catch an agent leaking PII in an edge case. They do not travel with the agent when it migrates to a new framework.

Microsoft’s announcement at Build 2026 on June 2 addresses this directly with two open-source tools: ASSERT, a policy-driven evaluation framework, and the Agent Control Specification (ACS), a portable runtime control standard. Both are MIT-licensed, framework-agnostic, and available on GitHub now. With two months of community adoption behind them, they are worth a serious look before your next agent ships to production.

What ASSERT Does — and Why Generic Benchmarks Can’t

ASSERT stands for Adaptive Spec-driven Scoring for Evaluation and Regression Testing. The core idea: your agent’s evaluation should start from your policies, not from a generic leaderboard. You write your governance requirements in plain YAML — acceptable topics, data handling rules, output constraints — and ASSERT converts them into targeted evaluation scenarios, datasets, and scorecards specific to your use case.

The practical payoff is large. A customer service agent at a financial institution has completely different safety requirements than a coding assistant at a software startup. Generic benchmarks cannot tell you whether your agent violates your organization’s data retention policy under a specific input pattern. ASSERT can, because it generates test cases from the spec you provide rather than from a fixed corpus.

The LLM-judge approach ASSERT uses reaches 80–90% agreement with human annotators, according to Microsoft Research validation data. That is credible enough for first-pass evaluation at scale, where the alternative is paying annotators to review thousands of agent interactions manually. The outputs are fully inspectable locally — spec, generated cases, model outputs, judge rationale, and metrics — which matters for compliance teams that need to audit how a safety decision was made, not just what it was.

ASSERT works across LangChain, CrewAI, LiteLLM, OpenAI, and custom stacks. CrewAI, Arize AI, LiteLLM, Pipecat, and Pydantic all backed the launch, suggesting the framework is already proving out in real production contexts.

ACS: Runtime Controls That Travel With the Agent

Evaluation tells you where the agent is failing. ACS tells you how to enforce controls at exactly those points — and ensures those controls survive a framework migration or a deployment to a new environment.

The Agent Control Specification defines five validation checkpoints in an agent’s lifecycle: input, LLM call, state, tool execution, and output. At each checkpoint, you place deterministic controls — classifier endpoints, LLM judges, custom content filters — written as portable YAML policy. The controls are versionable, auditable, and framework-independent by design.

Microsoft positioned ACS explicitly as the governance equivalent of MCP. That framing is deliberate: just as Model Context Protocol gave agents a standard way to connect to tools, ACS aims to give them a standard way to enforce safety rules — so security teams can review the policy once and have it applied everywhere the agent runs. The launch came with endorsements from KPMG, Zscaler, IBM Consulting, and Arize AI, which provides the observability integration that makes ACS controls auditable in production traces.

IBM’s global CTO for the Microsoft practice put the operational benefit plainly: “Centralized agent controls give us the ability to consistently apply policies, monitor behavior, and ensure accountability across complex environments, so our clients can deploy agentic AI with confidence.” That is the core enterprise pitch — one policy file, enforced at every agent boundary, regardless of which framework generated the agent.

The Workflow: Evaluate, Fix, Validate

ASSERT and ACS are most powerful as a closed loop rather than as independent tools. The intended workflow is three steps: run ASSERT to identify which policy requirements the agent is violating; use ACS to place controls at the specific checkpoints where failures occur; re-run ASSERT to confirm the controls work. Before-and-after metrics make the improvement legible to the stakeholders — security, legal, product — who need to sign off before production.

This matters because the most common alternative — scattered guardrails in prompts, hardcoded framework logic, vendor-specific filters — breaks down precisely when you need it most. When the agent changes, when it calls another agent, when it runs on a different platform, the controls scatter. ACS’s portable YAML approach prevents that fragmentation: the policy travels with the agent as a separate, auditable artifact.

For teams that want to go further, Microsoft’s broader Agent Governance Toolkit adds Agent Mesh (cryptographic identity for agents, inter-agent trust scoring on a 0–1000 scale), Agent Runtime (execution rings analogous to CPU privilege levels, plus a kill switch for emergency termination), and Agent Compliance (automated mapping to the EU AI Act, HIPAA, SOC2, and the OWASP Agentic AI Top 10). The Toolkit covers Python, Rust, TypeScript, Go, and .NET.

Why This Matters Two Months In

The Build 2026 announcement landed at a moment when enterprise agent governance has become an urgent problem. As we covered in July, 54% of enterprises now run AI agents in production but only 21% have a mature governance model. Gartner’s prediction that 40% of agentic AI projects will be canceled by 2027 cited governance and security bottlenecks as a primary driver. The timing is not accidental.

ASSERT and ACS are significant not just as tools but as an attempt to standardize a layer of the agent stack that has been completely ad hoc until now. The AI agent ecosystem has already converged on MCP for tool connectivity and A2A for agent-to-agent communication. If ACS achieves comparable adoption — and the breadth of endorsements at launch is a reasonable indicator — the runtime governance layer will have a standard vocabulary for the first time. Teams building agents today should at minimum run ASSERT on their current agents before the next deployment. Most will find gaps they did not know were there.

Further Reading

• Microsoft Foundry: Build agents you can trust — the full Build 2026 announcement with technical detail on ASSERT, ACS, Rubric, and the observability stack from Sarah Bird, responsible AI lead.
• ASSERT on GitHub — MIT-licensed, ready to run against your own agents with no Microsoft infrastructure required.
• Agent Governance Toolkit on GitHub — the broader runtime governance stack covering identity, execution rings, and OWASP Agentic AI Top 10 compliance.