Microsoft released the Agent Control Specification, an open-source standard that lets developers, compliance teams, and security teams define exactly what an AI agent can and cannot do across any framework. Known as ACS, the spec ships as an SDK with plugins for LangChain, the OpenAI Agents SDK, the Anthropic Agents SDK, AutoGen, CrewAI, Semantic Kernel, Microsoft.Extensions.AI, and MCP tools. It targets a specific operational problem: enterprises rolling out agents have no consistent way to express guardrails, and the workarounds they have today don't survive a move between frameworks.
ACS policy files specify what an agent may do, what it must not do, when a human should approve an action, and what evidence must be logged for review. Those policies are evaluated at four interception points during execution — before the agent receives input, before it calls a tool, after a tool returns a result, and before the final response goes to the user. At each point, a policy can allow, block, redact, or kick the decision to a person.
The status quo Microsoft is trying to displace is a patchwork. Today, teams stuff guardrails into system prompts, hard-code checks in application logic, or run classifiers on inputs and outputs to catch problems. Each works in isolation. None of them is portable, auditable, or reusable when an agent moves from one framework to another or one environment to the next.
Key facts
- 01Microsoft released the Agent Control Specification (ACS), an open-source standard for governing AI agent behavior across frameworks.
- 02ACS policy files check agent behavior at four interception points: before input, before tool call, after tool return, and before final response.
- 03The SDK ships with plugins for LangChain, the OpenAI Agents SDK, the Anthropic Agents SDK, AutoGen, CrewAI, Semantic Kernel, Microsoft.Extensions.AI, and MCP tools.
- 04Policies can allow an action, block it, redact sensitive information, or route the decision to a human for approval.
- 05ACS bundles policy as single files that travel with the agent across environments, addressing fragmented controls in current deployments.
ACS pushes those scattered controls into a single governance layer. Developers can plug in classifiers to categorize inputs and outputs, attach LLMs as policy judges, and write logic that inspects tool calls, tool selection, input accuracy, output usage, and the final response. Because the policies are written as standalone files, they travel with the agent as a bundle — a security rule defined once can follow the agent across LangChain, CrewAI, AutoGen, and the rest.
The timing tracks with what enterprises are actually hitting in production. Tool misuse — an agent calling the wrong API, passing data it shouldn't, or chaining tool calls into an action no one sanctioned — is one of the most common failure modes in agentic deployments. The cascading failure pattern, where one bad tool call poisons every subsequent step, is exactly what ACS interception points are meant to catch midstream rather than after the damage is done.
Framework coverage is the interesting choice here. By shipping plugins for the OpenAI Agents SDK and the Anthropic Agents SDK alongside its own Semantic Kernel and Microsoft.Extensions.AI, Microsoft is positioning ACS as infrastructure rather than a Microsoft product play. The enterprise pitch is that a compliance team can write one policy and have it enforced regardless of which lab built the underlying model or which open-source framework the developer chose.
The integration with MCP tools matters for the same reason. MCP — the Model Context Protocol — has become the default way agents reach external systems, and a governance layer that doesn't speak MCP can't see most of what an agent is actually doing. Tying ACS checks to tool calls at the MCP boundary gives security teams a place to enforce policy on the riskiest part of agentic execution.
The open question is adoption. Open-source specifications from large vendors have a mixed track record — they succeed when framework maintainers integrate them deeply, and they wither when they remain a wrapper that developers have to opt into. The plugin list at launch covers most of the popular agent frameworks in use, but the test is whether LangChain, CrewAI, and the SDK teams at OpenAI and Anthropic treat ACS as a first-class governance interface or a Microsoft-flavored shim. Without that, ACS becomes another control surface developers have to maintain.
Microsoft is making a bet that agent governance becomes a procurement requirement before it becomes a developer preference. Compliance and security teams at regulated enterprises — banks, insurers, healthcare systems — already ask for audit trails and human-in-the-loop sign-off on AI actions. A portable policy file that survives framework changes is precisely what those buyers want, and the company that owns the standard owns a meaningful piece of how agentic AI gets deployed at scale. Whether that company stays Microsoft depends on whether ACS becomes a real standard or just Microsoft's version of one.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
