18 years at Microsoft on core infrastructure: SQL Azure, Azure DevOps Code Search, Azure for Industries, Microsoft Learn, and the Agent Governance Toolkit. Since June 2026 I have been Chief Platform Officer at OPAQUE, where I build AgenTrust: the open specifications and runtimes that let an enterprise prove what an AI agent actually did.
My approach is Scale by Subtraction. The systems that survive are the ones where complexity was removed rather than layered on top.
Enterprises are giving agents real reach: email, CRMs, databases, financial systems. Most of the industry has tried to solve this at the content layer, with guardrails that screen what goes in and what comes out.
Guardrails help, and they leak. No filter reliably predicts a non-deterministic system. A single piece of untrusted content, an email or a document or a support ticket, can carry hidden instructions that redirect an agent into quietly exfiltrating internal data.
You do not run a regulated business on probably.
| Layer | What it does |
|---|---|
| Behavioral policy | What an agent is allowed to do. The policy engine I built in AGT, now Cedar policy evaluated on every tool call |
| Confidential computing | Hardware-attested execution on SEV-SNP and TDX, where data does not leak even if the software above it is compromised |
| Cryptographic proof | A signed record of what ran, under which policy, touching which data, that a third party can check offline |
Specifications and runtimes at agentrust-io.com. A live TDX quote verifies in your browser at agentrust-io.com/verify, and the runnable set is at agentrust-io.com/demos.
| Project | What it does | Where it is |
|---|---|---|
| TRACE | Portable signed runtime evidence: what ran, where, under which policy, touching which data, calling which tools, checkable offline by a third party | Spec v0.2. Hosted at the Linux Foundation as its own series, developed with AMD, Intel, Microsoft, OPAQUE and TII. Proposed to the Agentic AI Foundation sandbox as aaif/project-proposals#42 |
| Confidential MCP | A TEE-attested gateway that enforces Cedar policy on every MCP tool call and emits the TRACE record for it | v0.5.0, MIT |
| Agent Manifest | Hardware-anchors the 10 artifacts that define an agent at deployment: system prompt, policy bundle, tool schemas, model identity, RAG corpus, memory state, decision-log baseline, delegation chain, supply-chain provenance, approvals | Spec v0.2, Python SDK. In review as CoSAI WS4 issue #149 |
| Confidential A2A | Attested, attenuated agent-to-agent delegation and sealed peer channels as a profile on A2A, with an offline verifier and fail-closed SEV-SNP/TDX/TPM appraisal | v0.2.0 |
| Weight Custody Manifest | Custody for model weights deployed into customer-controlled and sovereign infrastructure, with a published threat model and stated limits | v0.28.2, Apache-2.0, pre-1.0 |
| TRACE test suite | Conformance tests, so TRACE support is something you run rather than something you assert | Public |
The open-source governance layer for production AI agents, stewarded by Microsoft under MIT.
pip install "agent-governance-toolkit[full]"
+------------------------------------------------------------------+
| AGENT GOVERNANCE STACK |
+------------------------------------------------------------------+
| AGENT HYPERVISOR | Runtime supervisor, Execution Rings (0-3) |
| (Runtime) | Joint Liability, Saga Orchestration |
+--------------------+---------------------------------------------+
| AGENT SRE | SLOs, chaos testing, canary deploys |
| (Reliability) | Incident response, runbook automation |
+--------------------+---------------------------------------------+
| AGENTMESH | Zero-trust identity, DID/SPIFFE, mTLS |
| (Trust) | A2A + MCP governance, behavioral scoring |
+--------------------+---------------------------------------------+
| AGENT OS | Policy enforcement kernel |
| (Kernel) | Capability-based access, Merkle audit logs |
+------------------------------------------------------------------+
10 formal specifications, 36 architecture decision records, SDKs for Python, .NET, TypeScript, Go and Rust, and governance plugins for Claude Code, Copilot CLI and opencode.
That OWASP number is a self-assessment against the published mapping, not a third-party audit. The three partials are agentic supply chain (ASI04), memory and context poisoning (ASI06), and human-agent trust exploitation (ASI09). AGT does not establish compliance with anything. It produces the evidence an auditor asks for.
| Capability | How it works |
|---|---|
| Execution Rings | CPU ring-inspired privilege isolation (Ring 0 to 3) for agent actions |
| VADP | Cryptographic delegation chains where each step narrows scope and never widens it |
| AgentMesh Identity | DID/SPIFFE-based durable cryptographic identity rather than ephemeral session tokens |
| Decision BOM | Reverse-traceable decision provenance over Merkle chains |
| GovernanceEventSink | Pluggable observability backend, no vendor coupling |
| Trust Score Decay | Configurable half-life, because a trust score from deployment day says nothing 6 months later |
- Architecting at Scale (Packt). 16 chapters in which each one solves the problem the previous chapter's solution created, following a single system, ShopFlow, from a monolith at 100 orders a day out to a globally distributed one. The companion repo carries the per-chapter code and all 73 Architect's Prompts.
- Proof, Not Promises, a weekly newsletter on LinkedIn. One project an edition, explained to the point where a reader could verify it.
- Notes, shorter and more frequent: a specific thing that broke, a spec line that does not hold, a fix that changed no behavior.
- awesome-ai-governance and awesome-auditable-ai, curated reading for the same problem.
| Body | What I work on |
|---|---|
| Linux Foundation | TRACE Specification, a Series of LF Projects, LLC |
| Agentic AI Foundation | Security and Privacy working group, and the TRACE sandbox proposal |
| CoSAI | WS1 software supply chain security, WS4 secure design for agentic systems |
| IETF SCITT | draft-mih-scitt-agent-action-capsule, draft-mih-sokolov-scitt-payload-binding |
| OWASP ASI | Agentic security integration, Top 10 for Agentic Applications |
| OpenSSF | Scorecard improvements, supply chain security patterns |
| Google ADK | AgentGovernancePlugin, governance lifecycle hooks for the ADK agent runtime |
| Oracle Agent Spec | ToolPolicy, ExecutionGuard, PolicyViolation tracing additions |