feat: add GovernanceEventSink SPI — AGT as event producer for SIEM/XDR integration by Copilot · Pull Request #1987 · microsoft/agent-governance-toolkit

Copilot · 2026-05-11T06:08:16Z

Description

Addresses the governance enforcement gap raised in the OS-level enforcement issue by implementing the provider-interface approach outlined by @Ricky-G: AGT becomes a structured event producer; enforcement backends (Defender, Falco, Tetragon, Sentinel, Splunk) act as sinks. No kernel code, no competing with EDR tools.

Core primitives (all four SDKs)

GovernanceEventCategory — 6 categories aligned with CloudEvents + OTEL conventions: policy.decision, policy.breach, identity.assertion, tool.invocation, sandbox.event, audit.chain
SignedGovernanceEvent — CloudEvents 1.0 envelope with HMAC-SHA256 tamper-evidence signature ("{type}\n{source}\n{time}\n{id}\n{data_json}")
GovernanceEventSink — single-method async interface/protocol; mirrors the existing SandboxProvider shape

Reference sinks

OtlpEventSink — routes to any OTLP-compatible backend (Defender for Cloud, Sentinel, Splunk, Datadog, Honeycomb, Dynatrace, Grafana). No new deps: Python uses existing optional opentelemetry-sdk; .NET uses built-in ActivitySource; TypeScript uses node:http; Rust writes OTLP JSON to a Write target.
StdoutEventSink — JSON lines to stdout; suitable for dev/CI and container log aggregators

.NET kernel wiring

GovernanceOptions gains EventSink and EventSigningKey. When set, the kernel bridges every AuditEmitter event to the sink as a signed SignedGovernanceEvent. Sink errors surface via Trace.TraceError (observable, non-blocking).

var kernel = new GovernanceKernel(new GovernanceOptions {
    EventSink = new OtlpEventSink(),
    EventSigningKey = Encoding.UTF8.GetBytes(signingKey),
});
// Every EvaluateToolCall() now emits a signed CloudEvents envelope to OTLP

sink = OtlpEventSink()  # or StdoutEventSink() for dev
event = SignedGovernanceEvent.build(
    GovernanceEventCategory.POLICY_DECISION,
    source="did:agentmesh:agent-1",
    subject="tool:file_write",
    data={"decision": "deny"},
    signing_key=key,
)
await sink.emit(event)
assert event.verify_signature(key)

Threat model coverage

Ask	Status
Cryptographically verifiable audit trail	✅ HMAC-SHA256 signed CloudEvents
External enforcement/visibility	✅ Falco/Tetragon/Defender become OTLP sinks
Bypass-resistant telemetry	⚠️ In-process; SIEM silence-as-signal pattern applies
eBPF/WFP/kernel drivers	❌ Out of scope — delegated to backend EDR tooling

Type of Change

Bug fix (non-breaking change that fixes an issue)
New feature (non-breaking change that adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update
Maintenance (dependency updates, CI/CD, refactoring)
Security fix

Package(s) Affected

Checklist

My code follows the project style guidelines (ruff check)
I have added tests that prove my fix/feature works
All new and existing tests pass (pytest)
I have updated documentation as needed
I have signed the Microsoft CLA

Attribution & Prior Art

This contribution does not contain code copied or derived from other projects without attribution
Any external projects that inspired this design are credited in code comments or documentation
If this PR implements functionality similar to an existing open-source project, I have listed it below

Prior art / related projects (if any):

Event schema follows CloudEvents spec v1.0 (Apache-2.0)
OTLP payload format follows OpenTelemetry Protocol (Apache-2.0)
Sink SPI shape mirrors the existing SandboxProvider pattern in this repo

AI Assistance

I can explain every meaningful change in this PR: what it does, why, and what tradeoffs were considered
I have run tests and verification appropriate for this change
No part of this PR was autonomously submitted by an AI agent without my review
I have not used AI to generate review comments on others' PRs

IP, Patents, and Licensing

This contribution does not implement patent-pending or patent-encumbered techniques
This contribution does not require an NDA or licensing agreement to understand or use
Any AI tools used have terms compatible with the MIT License

Related Issues

@Ricky-G

…d Rust Implements the provider interface (SPI) pattern described by @Ricky-G: - IGovernanceEventSink / GovernanceEventSink protocol (one async method) - SignedGovernanceEvent: CloudEvents 1.0 envelope + HMAC-SHA256 signature - GovernanceEventCategory enum (policy.decision, policy.breach, identity.assertion, tool.invocation, sandbox.event, audit.chain) - OtlpEventSink: routes events to any OTLP-compatible backend - StdoutEventSink: JSON lines to stdout (dev/CI) - GovernanceKernel (.NET) wired to forward audit events via event sink - Tests for all four SDKs (34 Python, 28 .NET, 23 TypeScript, 11 Rust) Agent-Logs-Url: https://github.com/microsoft/agent-governance-toolkit/sessions/d8eaa113-2391-466d-be07-76a474899c47 Co-authored-by: imran-siddique <[email protected]>

…forget observability) - Rust: remove hardcoded HMAC fallback key, use .expect() for clarity - .NET: make fire-and-forget sink errors observable via System.Diagnostics.Trace Agent-Logs-Url: https://github.com/microsoft/agent-governance-toolkit/sessions/d8eaa113-2391-466d-be07-76a474899c47 Co-authored-by: imran-siddique <[email protected]>

+        assert body["data"]["seq"] == 42
+
+    def test_multiple_emits(self):
+        for cat in GovernanceEventCategory:


+        Args:
+            event: The signed governance event to forward.
+        """
+        ...


+
+import asyncio
+import json
+import sys


+import asyncio
+import json
+import sys
+from io import StringIO


+from agent_os.event_sink import (
+    GovernanceEventCategory,
+    GovernanceEventSink,
+    OtlpEventSink,
+    SignedGovernanceEvent,
+    StdoutEventSink,
+    _hmac_sha256,
+)


+        SignedGovernanceEvent,
+        StdoutEventSink,
+    )
+except ImportError:


+    _HAS_OTEL_LOGS = True
+    _LogRecord = _LR
+    _SeverityNumber = _SN
+except ImportError:


github-actions · 2026-05-13T00:02:00Z

PR Review Summary

Check	Status	Details
🔍 Code Review	⏳ Pending	Awaiting results
🛡️ Security Scan	⏳ Pending	Awaiting results
🔄 Breaking Changes	⏳ Pending	Awaiting results
📝 Docs Sync	⏳ Pending	Awaiting results
🧪 Test Coverage	⏳ Pending	Awaiting results

Verdict: ⏳ Still running

github-actions · 2026-05-13T00:02:08Z

This PR is quite large. Consider breaking it into smaller PRs for easier review.

github-actions · 2026-05-13T00:02:12Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

Ricky-G · 2026-05-13T05:16:51Z

Proposal submitted for this, want to get Elton's view on this as well and then we can re-purpose this PR with the full implementation.

#2240

Initial plan

27a9b69

Copilot AI assigned Copilot and imran-siddique May 11, 2026

Copilot started work on behalf of imran-siddique May 11, 2026 06:15 View session

Copilot AI linked an issue May 11, 2026 that may be closed by this pull request

[Feature]: OS-Level Enforcement in AI Agent Governance #1793

Closed

1 task

Copilot AI and others added 2 commits May 11, 2026 06:34

Copilot AI changed the title ~~[WIP] Add OS-level enforcement in AI agent governance~~ feat: add GovernanceEventSink SPI — AGT as event producer for SIEM/XDR integration May 11, 2026

Copilot AI requested a review from imran-siddique May 11, 2026 06:39

Copilot finished work on behalf of imran-siddique May 11, 2026 06:39

github-code-quality Bot found potential problems May 11, 2026

View reviewed changes

Merge branch 'main' into copilot/feature-os-level-enforcement

193cf90

imran-siddique marked this pull request as ready for review May 13, 2026 00:01

github-actions Bot added the size/XL Extra large PR (500+ lines) label May 13, 2026

github-actions Bot added tests and removed size/XL Extra large PR (500+ lines) labels May 13, 2026

miyannishar mentioned this pull request May 14, 2026

feat: Docs/governance event sink spi proposal #2240

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add GovernanceEventSink SPI — AGT as event producer for SIEM/XDR integration#1987

feat: add GovernanceEventSink SPI — AGT as event producer for SIEM/XDR integration#1987
Copilot wants to merge 4 commits into
mainfrom
copilot/feature-os-level-enforcement

Copilot AI commented May 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 13, 2026

Uh oh!

github-actions Bot commented May 13, 2026

Uh oh!

github-actions Bot commented May 13, 2026

Uh oh!

Ricky-G commented May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Core primitives (all four SDKs)

Reference sinks

.NET kernel wiring

Threat model coverage

Type of Change

Package(s) Affected

Checklist

Attribution & Prior Art

AI Assistance

IP, Patents, and Licensing

Related Issues

Uh oh!

github-actions Bot commented May 13, 2026

PR Review Summary

Uh oh!

github-actions Bot commented May 13, 2026

Uh oh!

github-actions Bot commented May 13, 2026

Dependency Review

Scanned Files

Uh oh!

Ricky-G commented May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 11, 2026 •

edited

Loading