Microsoft offers devs a better way to control AI agent behavior

As AI agents turn ever much capable, enterprises racing to enactment them to enactment crossed applications, workflows, and products look a caller challenge: ensuring an cause does what it’s expected to bash erstwhile it’s deployed crossed antithetic environments.

Microsoft is trying to lick this occupation with a caller open-source modular called Agent Control Specification, oregon ACS, that aims to springiness developers a much accordant and granular mode to power what AI agents are allowed to do.

The specification fundamentally lets developer, compliance, and information teams specify their ain policies for agents to follow. The rules tin specify what the cause whitethorn do, what it indispensable not do, erstwhile a quality should o.k. an action, and what grounds should beryllium logged for aboriginal review. These argumentation files are checked astatine respective “interception points” erstwhile the cause is disconnected performing a task to marque definite it stays wrong the guardrails.

The spec comes arsenic developers are improvising ways to power what their AI sees and does, particularly with conversations focusing connected AI workflows going incorrect owed to tool misuse, oregon unintended actions that effect successful cascading failures.

Today, developers mightiness specify instructions successful a strategy prompt, adhd customized checks successful the exertion code, oregon usage classifiers to drawback problematic inputs and outputs. Those approaches work, but they often permission companies with fragmented controls that are hard to audit and harder to reuse crossed antithetic frameworks, interfaces, and systems.

Image Credits: Microsoft

ACS aims to integrate those controls into a communal governance layer. Microsoft says the specification tin beryllium utilized to cheque whether an cause is sticking to guardrails astatine aggregate points successful its workflow — earlier it receives input, earlier it calls a tool, aft a instrumentality returns a result, and earlier the last effect is sent to the user. A argumentation whitethorn let an action, artifact it, redact delicate information, oregon adjacent inquire a idiosyncratic to o.k. it.

Developers tin besides insert classifiers for inputs and outputs to categorize information, foretell outcomes, oregon find however an cause should respond; adhd LLMs with prompts to enactment arsenic a “judge” for policies; and logic for checking instrumentality calls, instrumentality selection, input accuracy, output usage, and responses.

And due to the fact that these policies tin beryllium written arsenic azygous files, they tin beryllium bundled with agents, allowing a information argumentation to travel an cause crossed antithetic frameworks and environments.

ACS is shipping arsenic an SDK with plugins for LangChain, the OpenAI Agents SDK, the Anthropic Agents SDK, AutoGen, CrewAI, Semantic Kernel, Microsoft.Extensions.AI, MCP tools, and more.