AEGIS
Sign in Start free

Head to head · updated 2026-07

AEGIS vs Microsoft Agent Governance Toolkit

Both are open-source. Both intercept AI agent tool calls at runtime. The difference is what they do after a decision fires — and how well they hold up when a regulator asks to see the paper trail.

This page is written by the AEGIS team — we've done our best to represent Microsoft AGT fairly, but read their official repo and decide for yourself.

The 8 things buyers ask about first

Capability
AEGIS
Microsoft AGT
Workflow-anchored policies
Same tool_name in two workflow nodes can carry different rules. AEGIS uses a compile-time UUID (binding_uuid > node_uuid > tool_name) as the policy anchor.
yes
no
Cryptographic audit chain (Merkle log)
AEGIS ships an Ed25519-signed transparency log with per-agent hash chain + optional witness cosignature (Team tier). Microsoft AGT logs decisions but does not currently ship a signed, third-party-verifiable chain.
yes
partial
EU AI Act Article 12–15 evidence pack
One-click export of a signed JSON pack, article-by-article, ready to hand to an auditor. High-risk-system obligations take effect 2026-08-02.
yes
no
Compensator + rollback infrastructure
AEGIS ships a saga engine with binding-scoped compensators, precedence chain, and audited rollback events. AGT stops at "block the call"; there is no undo path.
yes
no
Air-gapped deployment (offline mode)
AEGIS_OFFLINE severs cloud LLM calls at the app layer; NetworkPolicy in the shipped Helm chart enforces it at the CNI layer. AGT can run in a private VNet but does not have an equivalent kill-switch on its own outbound.
yes
partial
Regulation-cited preset DSL packs
AEGIS ships GLBA, PCI DSS 4.0, SOX, DORA, HIPAA, and FedRAMP Moderate as one-command policy imports, every rule cited to the specific clause.
6 packs
0
Runtime enforcement latency
Both use deterministic in-process walkers. Neither adds meaningful latency to the tool-call path.
sub-ms (DSL walker)
sub-ms
Natural-language policy compiler
AEGIS compiles English to a workflow-anchored DSL rule referencing the specific node UUID. AGT has an NL-to-policy path but does not resolve to workflow-graph identifiers.
yes (workflow-aware)
partial

Where the two products diverge

01

Workflow-anchored policies

AGT rules match on tool_name. AEGIS rules match on the specific workflow node UUID that produced the tool call. This matters the moment your send_email tool is called from three different agents inside the same workflow — with AGT you get one rule that either fires everywhere or nowhere. With AEGIS you get "block send_email when the caller is the marketing-agent node but pending when it's the support-agent node," compile-time referenced. 

version: 1
rules:
  - name: block-external-email-from-marketing
    when:
      all:
        - tool.name: send_email
        - workflow.node_id: "a3b1…9f7c"   # marketing-agent.send_email
    then:
      decision: block
      reason: "marketing agent may not initiate external email"
02

EU AI Act Article 12–15 evidence pack

The EU AI Act's high-risk-system record-keeping, transparency, human-oversight, and robustness obligations take effect 2026-08-02. AEGIS ships a one-command signed JSON export — article by article, with gap analysis — that an auditor can verify offline against the gateway's public key. AGT logs the same underlying events but does not currently bundle them into a regulator-facing artifact. If you're on the EU high-risk list and it's July, this is the biggest gap you'll hit.

→ See the evidence-pack UI

03

Compensator + rollback — not just "block"

AGT is a firewall. When it blocks a call, the flow stops. AEGIS ships a full saga engine: every tool binding can register a compensator (webhook, inline SQL, explicit none), and precedence flows binding_uuid → node_uuid → tool_name. If a stripe_refund hit prod and shouldn't have, the operator clicks Rollback in the cockpit and AEGIS runs the reverse action, records the rollback event, and updates the audit chain. There is no equivalent primitive in AGT.

04

Real air-gapped deploy — app + CNI

AGT can be pinned to a private VNet — but its own NL policy compiler still needs an Azure OpenAI endpoint that the VNet must reach. AEGIS ships two locks:

  • App layer: AEGIS_OFFLINE=1 causes the gateway itself to refuse any outbound call to a public LLM API. The NL compiler falls back to a local Ollama / vLLM adapter (or the heuristic backend).
  • CNI layer: the shipped Helm chart includes a NetworkPolicy that denies all egress from the gateway pod except cluster DNS + same-namespace services. Even if the app-layer check were bypassed, packets die at the kernel.

→ On-prem & air-gapped deployment guide

Full capability matrix

Capability
AEGIS
Microsoft AGT
Workflow-anchored policies
Same tool_name in two workflow nodes can carry different rules. AEGIS uses a compile-time UUID (binding_uuid > node_uuid > tool_name) as the policy anchor.
yes
no
Cryptographic audit chain (Merkle log)
AEGIS ships an Ed25519-signed transparency log with per-agent hash chain + optional witness cosignature (Team tier). Microsoft AGT logs decisions but does not currently ship a signed, third-party-verifiable chain.
yes
partial
EU AI Act Article 12–15 evidence pack
One-click export of a signed JSON pack, article-by-article, ready to hand to an auditor. High-risk-system obligations take effect 2026-08-02.
yes
no
Compensator + rollback infrastructure
AEGIS ships a saga engine with binding-scoped compensators, precedence chain, and audited rollback events. AGT stops at "block the call"; there is no undo path.
yes
no
Air-gapped deployment (offline mode)
AEGIS_OFFLINE severs cloud LLM calls at the app layer; NetworkPolicy in the shipped Helm chart enforces it at the CNI layer. AGT can run in a private VNet but does not have an equivalent kill-switch on its own outbound.
yes
partial
Regulation-cited preset DSL packs
AEGIS ships GLBA, PCI DSS 4.0, SOX, DORA, HIPAA, and FedRAMP Moderate as one-command policy imports, every rule cited to the specific clause.
6 packs
0
Runtime enforcement latency
Both use deterministic in-process walkers. Neither adds meaningful latency to the tool-call path.
sub-ms (DSL walker)
sub-ms
Natural-language policy compiler
AEGIS compiles English to a workflow-anchored DSL rule referencing the specific node UUID. AGT has an NL-to-policy path but does not resolve to workflow-graph identifiers.
yes (workflow-aware)
partial
A2A (agent-to-agent) observability envelope
Every child-agent trace carries parent_agent_id, delegation_reason, capability_grant, and a SHA-256 envelope hash. Foundation for Phase-5 runtime A2A gates.
yes
no
Local LLM adapter for NL compiler
AEGIS ships a Workers-friendly OpenAI-compat adapter. Point at any localhost:11434 endpoint and the NL compiler runs offline.
Ollama / vLLM / LM Studio
Azure OpenAI only
License model
AEGIS core is fully MIT; hosted service and enterprise SLAs are paid. AGT is MIT-only with no hosted offering — you run it yourself or nothing.
MIT (core) + paid Cloud
MIT
Native integration surface
AEGIS instruments open-standard SDKs (7 frameworks). AGT is deeply integrated with the Microsoft agent stack.
MCP, Anthropic, OpenAI, Bedrock, LangChain, CrewAI, Claude Agent SDK
Copilot Studio, Semantic Kernel, Azure AI Foundry
Cockpit / operator UI
AEGIS Cockpit is self-hosted; AGT lives inside Azure Portal / M365 admin.
shipped (Next.js)
shipped (Azure Portal)
Threat ontology coverage
AEGIS ships its own Agent Attack Taxonomy alongside OWASP mapping. AGT anchors on OWASP + Microsoft-internal signals.
AAT ontology (9 tactics)
OWASP LLM Top 10

Honest picking guide

Pick Microsoft AGT when

  • Your agents live inside Copilot Studio, Semantic Kernel, or Azure AI Foundry and you want native admin surfaces.
  • Your org already runs on Entra ID and you don't want a second identity plane.
  • You need a policy engine but no rollback or forensic evidence layer.
  • You have a Microsoft ELA and support is already paid for.

Pick AEGIS when

  • You need a signed evidence pack to hand a SOC 2, HIPAA, PCI, or EU AI Act auditor.
  • Your agents span multiple frameworks (MCP, Anthropic, OpenAI, LangChain, CrewAI) — one gateway for all.
  • You need rollback, not just blocking (financial ops, PII handling, code deploys).
  • You want true air-gapped deploy with app-layer + CNI-layer guarantees.
  • You need policies that reference the specific workflow node, not just the tool name.
  • You want to self-host without an Azure subscription.

Already on Microsoft AGT? Migrate in an afternoon

  1. Export your AGT policy YAML from the Azure Portal → Governance → Policies. AEGIS accepts the same allow / pending / block vocabulary; run agentguard policy import ./agt.yaml and the CLI emits a translated AEGIS DSL bundle.
  2. Point one non-critical agent at AEGIS via AEGIS_GATEWAY_URL. Traces flow to both AGT and AEGIS for a two-week overlap so you can diff decisions side by side.
  3. Cut over the remaining agents one workflow at a time. Compensators can be no-ops during the cut-over; enable them agent-by-agent once decisions are stable.
  4. Retire AGT when your evidence-pack snapshot on AEGIS covers the review window your auditor asks about (typically 90 days).

Compile your first rule in the browser.

No signup, no gateway to spin up — the compiler + evaluator both run client-side on the demo page.

Try the playground → See pricing