Microsoft unveils open-source standard to tame unruly AI agents

Enterprises racing to deploy AI agents across applications and workflows are hitting a wall: how to ensure these systems behave predictably in different environments. Microsoft’s answer is a new open-source specification called the Agent Control Specification (ACS), designed to give developers finer-grained authority over what agents can and cannot do.

ACS lets compliance, security, and engineering teams define policies in single files that spell out permitted actions, forbidden behaviors, human-approval triggers, and logging requirements. These policies are enforced at multiple interception points in an agent’s workflow—before it receives input, before it calls a tool, after a tool returns data, and before the final response goes to the user. Actions can be allowed, blocked, redacted, or routed for human sign-off.

Today, many teams cobble together controls using system prompts, custom code checks, or input-output classifiers. That works, but results in fragmented rules that are difficult to audit or reuse across frameworks and systems. ACS consolidates those controls into a shared governance layer that travels with the agent.

The spec also supports classifiers, LLM-based “judges” for policy evaluation, and logic for vetting tool calls, input accuracy, and output usage. Bundling policies as single files lets security rules follow an agent across environments and frameworks.

ACS ships as an SDK with plugins for LangChain, OpenAI Agents SDK, Anthropic Agents SDK, AutoGen, CrewAI, Semantic Kernel, Microsoft.Extensions.AI, and MCP tools. The goal is to give developers a consistent way to keep agents on task—without the improvisation.