Head to head
| Criterion | CIRIS | Microsoft Agent Governance Toolkit |
|---|---|---|
| Enforces policy before the action runs | Yes | Yes |
| Signed, tamper-evident decision records | Yes | Partial |
| Cryptographic agent identity | Yes | Yes |
| Kill switch / revoke a rogue agent | Yes | Partial |
| Published, enforced constitution | Yes | Partial |
| Independent third-party verification | Partial | Partial |
| Open source | Yes | Yes |
| Shipping in production | Yes | Partial |
Scored from public product docs as of July 2026. If we have a cell wrong, tell us and we will fix it.
Sources
- Enforces policy before the action runsCIRIS: CIRISAgent conscience_execution.py (H3ERE runtime gate) · Microsoft: Agent Control Specification (8 intervention points)
- Signed, tamper-evident decision recordsCIRIS: CIRISAgent audit (hash-chained + PQC-signed), CIRISConformance test_320 · Microsoft: ADR-0017 Merkle Audit Chain (spec; signing not confirmed in public docs)
- Cryptographic agent identityCIRIS: CIRISVerify hybrid Ed25519 + ML-DSA-65, 2-of-3 multi-source · Microsoft: Agent Mesh DID identity (Ed25519) + Entra Agent ID
- Kill switch / revoke a rogue agentCIRIS: CIRISVerify HUMANITY_ACCORD (fail-secure; any one named holder fires it, a majority lifts it) · Microsoft: Agent SRE emergency termination + Entra identity disable (reversible)
- Published, enforced constitutionCIRIS: The CIRIS Constitution binds every action; enforced via the conformance suite · Microsoft: Operator-authored YAML/Rego/Cedar policy; documented default_action: allow (ADR-0006)
- Independent third-party verificationCIRIS: Verifiable by design (walk the signed log) + conformance suite; external audits as needed · Microsoft: OpenSSF Scorecard / Best Practices badges (supply-chain hygiene, not decision verification)
- Open sourceCIRIS: AGPL-3.0 (network copyleft): CIRISAgent, CIRISVerify, CIRISConformance · Microsoft: MIT: microsoft/agent-governance-toolkit
- Shipping in productionCIRIS: CIRIS app on Apple App Store + Google Play today · Microsoft: Toolkit README: "Public Preview" (not yet GA)
What each does well
Microsoft's real strengths
The Agent Control Specification is a genuine stateless, deterministic, fail-closed policy runtime with eight named intervention points and a five-way verdict model (allow, warn, deny, escalate, transform). It ships DID-based Ed25519 identity, an emergency kill switch, and strong open-source engineering under a permissive MIT license, with deep Azure and Entra integration for enterprises.
Where CIRIS goes further
Every action passes through the conscience checks at runtime before it runs, not just a log written afterward. The audit trail is hash-chained and post-quantum signed, and independently re-verified by a separate conformance suite. The kill switch is a fail-secure two-of-three named-human quorum. And the constitution is fixed and published, not an operator-authored policy that defaults to allow.
This is one row of a bigger picture. See where both sit among every approach to AI accountability.