# Agent control contract comparison: October 2026

**Version:** 1.0
**Snapshot:** 2026-10-26
**Source:** KLA Digital (kla.digital/blog/agent-control-standards-owasp-microsoft-agt)

---

## About this comparison

This matrix compares OWASP's **Agent Control Standard** (release 0.1.4) with the **Agent Control
Specification** used by Microsoft's Agent Governance Toolkit (AGT), and the OWASP reference bridge
between them. It is source analysis unless the last column names a local run. Source identifiers
(S1–S8) are listed at the end with links pinned to the commits read on 26 October 2026. Refresh the
pins before relying on this snapshot after either project changes.

Local run: OWASP reference implementation at commit `4cf23d4`, Bun 1.3.14, Linux x86_64 with glibc
2.35. The decision-validation and failure-posture suites passed 94 of 94 tests (236 assertions). Two
runtime-dependent files could not load their native dependency, which requires glibc 2.39. No live
host, human approval or trace scenario was executed.

| Concern | OWASP Agent Control Standard, release 0.1.4 | Current AGT/upstream Agent Control Specification | Bridge and local evidence |
| --- | --- | --- | --- |
| Identity | Release 0.1.4, wire/spec/schema namespace 0.1.0; S1–S2 | Engine dependency 0.4.0-alpha.4; existing manifest 0.4.0-alpha.1, opt-in contract 0.5.0-alpha.1; S6–S7 | Old AGT commit and Node SDK 0.3.1-beta.0; S4 |
| Main boundary | Observed agent exchanges hooks and decisions with a Guardian; S3 | Host submits a complete snapshot to a stateless runtime and enforces the result; Agent Hooks defines interception; S6–S8 | Tool-call request/result paths demonstrated by source; full current-runtime compatibility unverified |
| Decision vocabulary | ALLOW, DENY, ASK, DEFER mandatory support; MODIFY SHOULD-support, with defined incapable-client handling; S3 | Normalized allow, deny, transform. warn becomes allow with warnings; escalate becomes a liftable deny carrying approval; S6 | Old mapper consumes five verdict labels and emits allow/deny/ask/modify; no defer producer; S4–S5 |
| Human approval | ASK details, timeout and approver capability have defined behavior; S3 | Host owns approval resolution; deny with approval is liftable through that seam; S6 | Reference README discloses missing ask_details in its producer; not independently exercised through native engine |
| Changes to input | MODIFY must follow composition and applicability rules; unsupported cases have explicit fallback; S3 | Host validates/applies transform under its enforcement mode; S6 | Local decision-validation suite exercised malformed/overlapping/non-applicable changes and output projection; passed |
| Delivery failure | Negotiated on_decision_failure; default proceed with required audit. Other failure classes have separate rules; S3 | Runtime errors yield deny; Agent Hooks also describes host behavior/postures. Engine outcome alone does not establish deployment behavior; S6–S8 | Local posture suite exercised proceed/deny, refusal classification and audit failure; passed |
| Decision expiry | ASK and DEFER have timeout semantics; S3 | Approval resolution and host contract must be consulted; no universal direct DEFER equivalence asserted | Local host tests: expired ASK/DEFER default deny, with specified substitutions and boundary conditions |
| State | Session context/chain contract; S3 | Stateless evaluations depend on full host-supplied snapshots; S6 | Bridge's source-maintained session chain does not by itself prove full wire conformance; S4 |
| Integrity and replay | Baseline envelope HMAC and replay protection are Core; stronger cryptographic profiles are separate; S3 | Trusted host and in-process interception model; S8. Transport/deployment integrity needs its own assessment | Reference documents absent signing/authentication/replay checks; these are disclosed limitations, not new discoveries |
| Trace evidence | Release 0.1.4 joins request and session identifiers; matching decision-failure events exclude an enforcement claim; S2 | Host enforcement and telemetry/evidence are distinct responsibilities; S6–S8 | No complete trace corpus or end-to-end enforcement result collected here |
| Coverage claim | Core and optional profiles are self-declared; inspect actual capability/requirements; S3 | Eight intervention points; trusted host, no promise of complete mediation; S8 | Only 94 host-helper tests run successfully; no deployment conformance claim |

## Questions for an integration review

For a proposed governed action, record the intercepted host path, decision request, policy version, decision, approval identity if required, exact input approved, applied transform, actual dispatch and observed result. Identify failure classes and required behavior before testing. A field present in a schema is not evidence that a particular host supplies or honors it.

| Scenario | Observation needed | This review |
| --- | --- | --- |
| Denied tool call | Host prevents dispatch | Helper behavior/source reviewed; live native path unverified |
| Approval followed by changed input | Approval binds the action actually dispatched | Not executed |
| Decision service unavailable | Chosen posture, resulting action, audit event | Host-helper test coverage passed; live host unavailable-path not run |
| Expired decision | Time boundary and fallback outcome | Host-helper test coverage passed |
| Replayed request | Duplicate detection and recorded disposition | Missing reference protection disclosed by upstream; no live probe |
| Transformation cannot be applied | Safe fallback and evidence | Host-helper test coverage passed |
| Decision recorded but host fails to apply | Joined decision/failure evidence | Normative Trace contract reviewed; trace scenario not executed |

These cells keep static, helper-level and live observations distinct. No pair of project names alone establishes interoperability.

## Sources

| ID | Source |
| --- | --- |
| S1 | OWASP Agent Control Standard, [published tree](https://github.com/GenAI-Security-Project/agent-control-standard/tree/4cf23d4cce832e522ffab69e7dd8d7209ec11a9a), release 0.1.4 |
| S2 | OWASP, [CHANGELOG.md](https://github.com/GenAI-Security-Project/agent-control-standard/blob/4cf23d4cce832e522ffab69e7dd8d7209ec11a9a/CHANGELOG.md) |
| S3 | OWASP, [conformance profiles](https://github.com/GenAI-Security-Project/agent-control-standard/blob/4cf23d4cce832e522ffab69e7dd8d7209ec11a9a/docs/spec/conformance.md) and [instrument specification](https://github.com/GenAI-Security-Project/agent-control-standard/blob/4cf23d4cce832e522ffab69e7dd8d7209ec11a9a/docs/spec/instrument/specification.md) |
| S4 | OWASP, [reference implementation README](https://github.com/GenAI-Security-Project/agent-control-standard/blob/4cf23d4cce832e522ffab69e7dd8d7209ec11a9a/reference-implementations/agt/README.md) and [agt.lock](https://github.com/GenAI-Security-Project/agent-control-standard/blob/4cf23d4cce832e522ffab69e7dd8d7209ec11a9a/reference-implementations/agt/agt.lock) |
| S5 | OWASP, [verdict mapper](https://github.com/GenAI-Security-Project/agent-control-standard/blob/4cf23d4cce832e522ffab69e7dd8d7209ec11a9a/reference-implementations/agt/packages/guardian/src/map-verdict.ts) and [host adapter](https://github.com/GenAI-Security-Project/agent-control-standard/tree/4cf23d4cce832e522ffab69e7dd8d7209ec11a9a/reference-implementations/agt/packages/host-adapter) |
| S6 | Microsoft AGT, [ACS guide](https://github.com/microsoft/agent-governance-toolkit/blob/46b370e77b7c13569d7525e337e31a9d3216c0b9/docs/packages/agent-control-specification.md) and [retarget contract](https://github.com/microsoft/agent-governance-toolkit/blob/46b370e77b7c13569d7525e337e31a9d3216c0b9/policy-engine/docs/acs-retarget.md) |
| S7 | ResponsibleAI, [Agent Control Specification](https://github.com/responsibleai/agent-control-spec/blob/0ade4afc63041c7a1ff7104962ea43246686c8d1/spec/SPECIFICATION.md), draft 0.5.0-alpha.1 |
| S8 | ResponsibleAI, [Agent Hooks README](https://github.com/responsibleai/agent-hooks/blob/a90e56e91a6ef226c15eb84842efa411423e85c7/README.md) |

The old bridge pins Microsoft AGT commit `81955d48025c6b11deb3fc9dabf89f74f4145775` and Node SDK
`agent-control-specification@0.3.1-beta.0`. That pin is older than the AGT commit reviewed in S6.