Your agent will do something you didn't expect. Every team that has run agents in production for more than a few weeks knows this. The question isn't whether it happens — it's whether your system is designed for that moment.

Microsoft's Agent Governance Toolkit is a well-engineered answer to one version of that question: can we evaluate a declarative policy around a tool call — before it fires, and immediately after? The answer is yes, and AGT does it well. Sub-millisecond evaluation across a four-stage pipeline. A solid test corpus. A real compliance story.

But a policy pipeline scoped to a single tool call's lifecycle is not the whole question. It's the first clause of a much longer sentence — and everything that spans turns, sessions, and a full spawn tree is where production failures actually live.

This post is for teams making a governance platform decision today. We'll walk through what each approach covers, where the coverage ends, and why the teams building serious agent infrastructure at scale are landing on Waxell.

TL;DR

The Governance Gap AGT Doesn't Cover

AGT's architecture is explicit about its boundary: it governs agent actions, not LLM inputs or outputs, and it runs in-process across a documented pipeline — pre_input → pre_tool → post_tool → pre_output. That pipeline does real work on both sides of a tool call: it evaluates before dispatch, and its post-tool stage sanitizes outputs (stripping PII, appending verification footers) before they propagate further.

That's a clearer, more capable design than "before a call, then nothing" — but it's still scoped to a single call's lifecycle. It means AGT's governance surface ends at the boundary of the call it's evaluating, not at the boundary of the run.

The six failure modes that appear repeatedly in production agent deployments are: runaway loops (the agent re-calls itself or a tool repeatedly), scope creep (the agent pursues a goal beyond the original instruction), data leakage (the agent surfaces data in its output that it shouldn't have retrieved), hallucination-in-action (the agent acts on a false premise mid-run), prompt injection (a retrieved document redirects agent behavior), and cascade failures (one agent's output becomes another agent's bad input across a spawn tree).

AGT can address some pre-conditions for some of these failures, and its post-tool sanitization can catch some bad outputs at the moment a specific call returns them. A rule that blocks a recursive tool call can interrupt a loop — once. A capability check can prevent scope creep at a specific tool invocation. But nothing in a per-call pipeline can stop a loop that's unfolding across 40 turns, because no single call in that sequence looks like a policy violation on its own. It can't gate an output at the point where it crosses from one agent's session into a different agent's session days later. It can't suspend a run when cumulative spend across an entire spawn tree crosses a threshold that no individual call would trip.

These aren't edge cases. They're the failure modes that matter in production.

Three Planes of Governance

Every production agent deployment has three surfaces that need governance. Most governance tools cover one.

Plane 1: External and third-party agents. Agents running in external environments — developer tooling, CI pipelines, customer-facing sessions, third-party integrations — operate outside any framework instrumentation. They call your APIs, they read your data, they act on behalf of your users. But they're not running in a process you control, and they can't have framework adapters attached to them.

Plane 2: Framework-built agents. Agents built on LangChain, CrewAI, AutoGen, Semantic Kernel, and similar frameworks. This is where most governance tooling lives, because these frameworks provide attachment points for instrumentation and policy hooks.

Plane 3: The agentic runtime itself. The infrastructure layer that handles agent spawning, state persistence, suspension, resumption, and inter-agent communication. Governance at this layer means enforcing policies on the execution fabric, not just on individual tool calls.

AGT operates primarily on Plane 2. Its adapters attach to framework-built agents. Its in-process model has no surface for Plane 1 agents, and its saga orchestrator provides some runtime governance (compensating transactions for in-session failures) but no cross-session enforcement on Plane 3.

Waxell covers all three. The instrumentation layer auto-instruments 200+ libraries across frameworks (Plane 2). External agents emit structured events attributed to the same governance surface via the Waxell installer (Plane 1). The Runtime SDK governs the execution fabric directly — spawn, suspend, resume, budget enforcement, human gates — without requiring any framework attachment (Plane 3).

The Execution Arc: Pre, Mid, and Post

The simplest way to describe the architectural difference is the execution arc — not "before vs. after a call," but "within one call's lifecycle vs. across the full run."

AGT covers the boundary around a single tool call. Its four-stage pipeline evaluates before dispatch and sanitizes output after. That's real coverage, and earlier framings of this comparison that described AGT as doing nothing once a call is allowed understated what its post-tool stage does.

Waxell covers the full arc across turns, sessions, and spawn trees — and the response options are richer.

Where AGT's disposition per call is allow, deny, or sanitize, Waxell's incident disposition model works like cloud infrastructure security: warn, block, or redact, scoped per policy category, and evaluated against state that spans the whole run rather than a single call. A tool call that trips a budget threshold can be warned rather than blocked on the first occurrence, letting a human review before enforcement escalates. A response containing PII that shouldn't leave the tenant boundary can be redacted before it reaches the next agent in the chain, rather than halting the run entirely. The response is proportionate to the violation — which is how mature security systems work.

Pre-execution: Tool calls are checked against declared rules before dispatch. Fast enough to not block hot paths.

Mid-execution: This is the governance surface that doesn't exist in AGT's per-call model. An agent is mid-run. It has made four tool calls. Its spawn tree has consumed $8 of the $10 budget threshold. The next tool call is permitted by policy — no single call has crossed a line — but by the time it completes, the cumulative spend across the tree will exceed the threshold. Waxell's BudgetLedger enforces at this boundary — the enforcement isn't "did this specific call violate a rule?" but "does the current execution state, aggregated across the whole tree, violate a constraint?"

Mid-execution also covers suspension and human gates. An agent drafts a document that will be sent to a customer. Before dispatch, a human review gate fires. The run suspends — for minutes, hours, or days. The reviewer approves or rejects. The run resumes or terminates. None of this is expressible in a per-call policy pipeline, however many stages it has.

Post-execution: Output gates, cost settlement, audit closure, RunEdge DAG completion. Waxell records the full causal graph after each run — what spawned what, which decisions led to which actions, what the cost was across the full tree. Post-execution governance means you can write policies that look at run history, not just the current call's inputs and outputs.

The Dynamic Policy Engine

AGT's policies are authored as declarative files — YAML, OPA/Rego, or Cedar — in a policies/ directory. Applying a change to an already-authored policy doesn't require a full redeploy: AGT supports runtime policy reload (reload_policies(), or automatic hot-reload when OPA runs in Remote Server mode) without restarting the agent. What AGT doesn't have is a no-code authoring surface: someone still needs to write or edit the YAML, OPA/Rego, or Cedar file itself.

This is fine when policy authorship naturally sits with people who write code — many security and compliance functions do. It becomes a bottleneck when the people who understand a new policy need don't work in a code repository at all: a compliance officer responding to a new regulation, a security lead who wants a new rule live in the next ten minutes, not the next PR review cycle.

Waxell's policy engine removes the file format entirely from the authorship path. Policies are injectable at runtime through the platform UI or API — no YAML, OPA, or Cedar syntax required. Different agents can run under different policy sets. Different fleets can have different enforcement profiles. A compliance officer can author a new policy and push it through the platform UI without opening a terminal, editing a file, or filing a deployment ticket.

The policy surface is structured. Waxell ships 50+ policy categories — covering data handling, cost, tool access, output content, identity, inter-agent communication, and more — each with its own scoping controls. Rather than writing rules from scratch against an open schema, teams configure governance against a taxonomy that was built from the actual categories of violations that surface in production.

The evaluation is fast — governance at the pre-execution boundary doesn't add perceptible latency to tool dispatch, for either system. But the organizational implication is the bigger difference: AGT's policy authorship still assumes a developer or someone comfortable in a policy file format. Waxell's doesn't require either.

When a compliance team needs to respond to a regulatory inquiry at 3pm on a Friday, they don't want to be blocked on someone available to write and test a YAML file. When a security team identifies a new class of tool call that should require elevated review, they want to push that requirement now, not at the next sprint boundary.

The Data Layer: Where Tool-Call Governance Ends

There's a category of agent behavior that no tool-call policy can fully govern: data retrieval into context.

An agent with permission to call a search tool, a retrieval function, or a vector database query can surface any data those systems return. The tool call is allowed. AGT's post-tool sanitization can strip PII from a tool's direct output — but it can't govern what the agent does with that data once it's in context, or prevent it from propagating through the agent's reasoning and into a spawned sub-agent's input.

For most enterprise agent deployments, this is the actual risk surface. Not "will the agent call a restricted tool?" but "will the agent retrieve data it shouldn't have, reason over it, and pass it to the next agent in a spawn chain?"

Waxell's Signals and Domains schema extends governance to the data layer. You declare which agents can access which data sources, at what granularity, under what conditions. The policy enforcement happens at the retrieval boundary — before the data enters the agent's context — not only at the tool-output boundary where AGT's sanitization runs.

This closes a gap that per-call, output-focused governance cannot close on its own. An agent can be well-governed at the AGT tool-call and output-sanitization level and still carry ungoverned data through its reasoning into a downstream spawn. The governed data access layer is the answer to that exposure.

Policy Management: Who Owns Governance at Your Organization?

This is the operational question that doesn't appear in most governance tool comparisons, but it determines whether your governance investment actually functions in production.

With AGT, the people who can author or edit policies are the people comfortable writing YAML, OPA/Rego, or Cedar — a developer or policy-engineer profile, even though applying an already-written change doesn't require a redeploy. For teams where security and compliance are embedded in engineering, this works fine. For teams where governance ownership sits with a compliance function, a legal team, or a dedicated security organization that doesn't write policy-as-code, it creates a structural dependency on whoever can author the file.

Every compliance requirement that needs to become a new enforcement rule has to go through someone who can write it in AGT's policy format. Every policy update for a new customer requirement becomes a request to that person or team.

Waxell's policy engine breaks this dependency entirely. Compliance teams author and manage policies directly through the UI — no file format in between. The platform provides the enforcement infrastructure; the teams that understand the regulatory context provide the rules without needing to learn a policy language. The separation is clean: platform engineering manages Waxell itself; compliance and security manage what runs on top of it.

For regulated industries — financial services, healthcare, legal, any team operating under data residency or audit requirements — this separation isn't a preference. It's a prerequisite.

Production Evidence vs. Whitepaper

AGT is a serious piece of engineering. The codebase is well-tested, the architecture is sound, and the threat model it was designed against is real. But it was designed against a threat model — a structured analysis of what agent governance should address, written before most of the teams now running production agents had encountered the failure modes they needed to govern.

Waxell's governance patterns — budget boundaries, tool-level policy, output gates, kill switch — were designed from incidents. The failure mode taxonomy (loop, scope creep, data leakage, hallucination-in-action, prompt injection, cascade) wasn't derived from a whitepaper. It was catalogued from actual production failures across millions of agentic executions.

This matters for a few reasons that aren't immediately obvious.

First, the edge cases. A threat model anticipates known attack vectors. Production evidence surfaces failure modes that weren't anticipated. The runtime governance patterns in Waxell reflect the shape of failures that teams encountered after they thought they had things under control.

Second, the performance profile. Fast policy evaluation in a benchmark is not the same as fast policy evaluation in a multi-agent spawn tree under real load. Waxell's evaluation performance is calibrated against actual production traffic patterns, not synthetic benchmarks.

Third, the coverage decisions. Every governance system makes tradeoffs about what to enforce and how. Waxell's tradeoffs were made in response to real operational pain. That doesn't make them universally correct — but it does mean they were tested against the actual problem before they shipped.

The Operational Stack

For teams running AGT today and evaluating whether to stay, add to, or replace it, here's the honest picture of what you're managing:

If you keep AGT only: You have policy enforcement scoped to each tool call's lifecycle for framework-attached agents, including post-tool output sanitization. You have an audit log of policy events and a flight recorder for post-mortem replay. You're building observability, cost tracking beyond rate limits, durable execution, and external agent coverage yourself or assembling it from separate tools. You're also accepting that every new policy still needs someone who can author it in AGT's file format, even though applying an existing change doesn't require a deployment.

If you move to Waxell: You get the full execution arc across all three planes, the dynamic policy engine with no-code authorship, the governed data access layer, BudgetLedger, durable execution, RunEdge causal DAG, and external agent observability under one governance surface. Policy authorship is decoupled from any file format or engineering-adjacent skill.

The migration path is straightforward. Waxell auto-instruments 200+ libraries at process start — add waxell.init() before your agent initialization, and span-level tracing begins immediately for every LLM call and tool dispatch. Cost records, causal lineage, and budget enforcement layer on top without requiring instrumentation code.

Three Questions to Frame the Decision

If you're deciding now:

1. Who needs to author policies when something goes wrong? If the answer is "someone who doesn't write YAML, OPA, or Cedar," you need a no-code policy engine, not just a hot-reloadable one.

2. Where does your actual risk surface live? If it's in data retrieval into context as much as tool dispatch — and for most enterprise deployments, it is — you need data layer governance, not just tool-call and tool-output governance.

3. What failure modes are you governing for? If you've been running agents in production and you've seen loops, scope creep, or cross-agent data contamination, you need enforcement that spans turns and sessions. A per-call policy pipeline, however many stages it has, can't stop a failure that only becomes visible across the arc of a run.

AGT is a legitimate answer to a specific, well-scoped problem. For teams that need exactly that scope — framework-attached, file-authored (if hot-reloadable), per-call policy enforcement — it's a defensible choice, especially if you're already pairing it with Microsoft Agent 365 for tenant-level oversight.

For teams that need governance to match the full complexity of how agents fail in production, Waxell is built for that.

Getting Started

pip install waxell-observe[all] waxell-sdk

export WAXELL_API_KEY="wax_sk_..."
export WAXELL_TENANT="your-tenant-slug"

pip install waxell-observe[all] waxell-sdk

export WAXELL_API_KEY="wax_sk_..."
export WAXELL_TENANT="your-tenant-slug"

pip install waxell-observe[all] waxell-sdk

export WAXELL_API_KEY="wax_sk_..."
export WAXELL_TENANT="your-tenant-slug"

pip install waxell-observe[all] waxell-sdk

export WAXELL_API_KEY="wax_sk_..."
export WAXELL_TENANT="your-tenant-slug"

pip install waxell-observe[all] waxell-sdk

export WAXELL_API_KEY="wax_sk_..."
export WAXELL_TENANT="your-tenant-slug"

Add waxell.init() at process start. Spans appear immediately. For the full governance stack — dynamic policy engine, governed data access, BudgetLedger enforcement — see the platform overview or start free at https://waxell.dev/signup.

Waxell is the hosted platform for running, observing, and governing AI agents in production. Built on millions of agentic executions.

Frequently Asked Questions

Does Waxell replace AGT, or do teams run both?
For most production teams, Waxell replaces AGT rather than running alongside it. AGT's in-process policy pipeline covers tool-call governance — evaluation before dispatch and sanitization after — for framework-attached agents, a real capability with a clear boundary around each call. Waxell covers the full governance arc: pre, mid, and post-execution enforcement that spans turns and sessions, governed data access at the retrieval layer, a policy engine with no file format in the authorship path, and observability across all three agent planes. When Waxell's policy engine is configured, the per-call governance that AGT provides is largely redundant — Waxell handles that at the same boundary, with richer disposition options (warn, block, or redact) and without any policy-file authorship step. If you have AGT deployed and are evaluating the transition, pip install waxell-observe[all] waxell-sdk and waxell.init() before your existing agent initialization begins the migration. The full comparison covers the architectural differences in detail.

Does Microsoft have a hosted alternative to AGT?
Not built into AGT itself, but yes at the Microsoft-stack level: Microsoft Agent 365 reached general availability on May 1, 2026 as a managed, four-layer governance framework (Purview, Entra ID, Defender) operating at the tenant/fleet level. It sits above per-agent runtime tools like AGT rather than replacing them — Microsoft's own documentation distinguishes the two. If you're comparing "Microsoft's governance stack" as a whole against Waxell, Agent 365 is worth including in that comparison; if you're comparing AGT specifically as a per-agent policy library, the distinctions in this post still apply to AGT itself.

What does "mid-execution enforcement" actually mean in practice?
Pre-execution governance checks whether a specific tool call is permitted before it fires. Mid-execution governance checks whether the current state of the run satisfies a constraint — regardless of whether any individual tool call violated a rule. The clearest example is cost: a run may be well within budget at every individual tool call, but the cumulative spend across a spawn tree can cross a threshold mid-run, with no single call ever looking like a violation on its own. Waxell's BudgetLedger enforces at that boundary, not at the per-call level. Similarly, human review gates are a mid-execution construct: the run reaches a decision point, suspends, waits for a reviewer, and resumes — something a per-call policy pipeline has no mechanism to express, regardless of how many stages that pipeline has.

How does Waxell's dynamic policy engine work — can non-technical teams actually manage policies without deployments?
Yes. Policies in Waxell are managed through the platform UI and API, not through files in a code repository or a declarative policy language. A compliance officer can author a new policy, update an existing one, change enforcement scope, or push a change immediately — no deployment ticket, no engineering queue, and no need to learn YAML, OPA/Rego, or Cedar. The policy engine evaluates against Waxell's 50+ structured policy categories, so teams are configuring governance against a taxonomy rather than authoring rules from scratch against an open schema. Platform engineering manages the Waxell infrastructure; compliance and security manage what runs on top of it. The separation is clean and doesn't require embedding governance ownership inside the engineering team.

What is the data layer governance Waxell provides, and why doesn't tool-call policy cover it?
Tool-call governance can block a retrieval function from being called, and AGT's post-tool stage can even sanitize what that specific call returns. But neither controls what the agent does with that data once it's in context, or prevents it from propagating through the agent's reasoning and into downstream agents. Waxell's Signals and Domains schema extends policy enforcement to the retrieval boundary — before data enters the agent's context — not just at the call or output boundary. For enterprise deployments where the real risk is an agent surfacing data it shouldn't have retrieved, or passing sensitive data to a spawned sub-agent, per-call governance alone leaves the exposure open. Data layer governance closes it.

How quickly can we get started?
Basic observability starts in minutes: add waxell.init() before your existing agent initialization and spans begin appearing immediately for every LLM call and tool dispatch. No instrumentation code required — Waxell auto-instruments 200+ libraries at process start. Cost records and causal lineage layer on top automatically. The BudgetLedger integration and dynamic policy engine require additional configuration; the platform overview covers the steps. Start free at https://waxell.dev/signup.

Sources

• Microsoft Agent Governance Toolkit — GitHub — source for AGT architecture, scope, and documented non-goals

• Introducing the Agent Governance Toolkit — Microsoft Open Source Blog, April 2, 2026

• Agent Governance Toolkit: Architecture Deep Dive — Microsoft Tech Community

• OWASP Agentic Top 10

• SPIFFE — Secure Production Identity Framework For Everyone

• Waxell Platform Overview

• Waxell Governance Documentation