Agent governance · Where Containment.AI fits

When an agent can act on real data, controlling its behavior isn't enough.
You also have to govern what data crosses the LLM boundary.

Containment.AI runs one governance discipline across two tiers. The connected tier surface compared here is the data-layer control for autonomous agents: an HTTPS proxy in front of OpenAI, Anthropic, and Bedrock that inspects every prompt and completion and decides whether the regulated content inside the call is allowed to leave. (For the highest-assurance end, the same discipline is delivered in-path by the flagship High-Assurance Gateway.) Agent-runtime tools govern what an agent does; we govern what its actions carry. This page is an honest, side-by-side look at how that compares to a tool-layer governance toolkit — and why most teams shipping agents on regulated data want both layers.

Looking for the product, not the comparison? Start with Agent Governance. Last reviewed 2026-06-10; revised when a release changes the comparison.

TL;DR

Containment.AI is stronger on the data layer: a catalog of content-class detectors (HIPAA PHI, MNPI, ITAR/EAR, secrets, prompt injection, and more), real-time redaction so the agent keeps working while sensitive bytes are stripped, and a multi-LLM proxy with no agent-framework lock-in. The comparison case here, Microsoft's Agent Governance Toolkit (AGT), is stronger on the tool-call layer: zero-trust agent identity (SPIFFE / DIDs), OWASP Agentic Top 10 coverage, and execution sandboxing.

Neither product replaces the other. The honest pitch: if you ship autonomous agents on Azure Foundry, LangGraph, CrewAI, or the Microsoft Agent Framework, you probably want both — agent-runtime governance for behavior, and Containment.AI for the data crossing the LLM boundary.

Two layers of agent governance

AGT sits at the function-call boundary inside the agent process. Containment.AI sits at the HTTPS boundary to the LLM provider. They see different things and answer different questions.

Tool-call / action layer

Microsoft AGT

  • In-process SDK (@govern wrapper for Python, TS, .NET, Rust, Go)
  • Intercepts tool-function invocations: file ops, shell, MCP, inter-agent
  • Zero-trust agent identity (SPIFFE, Ed25519, DIDs)
  • OWASP Agentic Top 10 (10/10) + NIST AI RMF mappings
  • Decisions: allow / deny / require_approval
  • MIT, free, Microsoft-maintained
Data / LLM-boundary layer

Containment.AI

  • HTTPS proxy in front of OpenAI, Anthropic, Bedrock, Azure OpenAI, Vertex
  • Inspects every prompt and completion crossing the boundary
  • A catalog of deterministic content-class detectors — PHI, MNPI, ITAR/EAR, secrets, PII, source-code leakage, prompt injection, shadow-AI, and more
  • Decisions: allow / block / redact — agent keeps working, sensitive bytes don't leak
  • Audit-grade decision logs designed for SOC 2, HIPAA, ISO 27001, ITAR, and EAR evidence needs
  • Single-tenant deploy option for federal / regulated workloads

Honest feature matrix

No marketing-speak. Where AGT is stronger, we say so. Where we are stronger, we say so. Where the gap is structural, we explain it.

Capability Microsoft AGT Containment.AI
Architecture In-process SDK / function wrapper HTTPS proxy in front of LLM providers
Interception point Tool / function calls; inter-agent messages Every byte going to or from the LLM provider
Decision verbs allow / deny / require_approval allow / block / redact (substitute sensitive content with placeholder; agent keeps working)
Zero-trust agent identity (SPIFFE / DID / mTLS) Yes — AGT's strength. No (we identify humans and orgs, not agents)
Execution sandboxing / privilege rings Yes — AGT's strength. No
OWASP Agentic Top 10 mapping 10/10 covered Partial (prompt injection only; the rest are behavior classes that AGT is the right layer for)
PHI (HIPAA) detection Not in shipped scope Yes — dedicated detector
MNPI / insider-trading content detection Not in shipped scope Yes — dedicated detector
ITAR / EAR export-control detection Not in shipped scope Yes — dedicated detector
Secrets / API-key leakage detection Not in shipped scope Yes — dedicated detector
Prompt-injection detection Yes (12-vector PromptDefense evaluator) Yes (content-pattern + behavioral signals)
Shadow-AI discovery Repo / process / config scanning Actual API traffic observation (catches BYOK / personal-key bypass)
Multi-LLM provider coverage LLM-agnostic at the tool layer (no provider-specific code) LiteLLM-based — 100+ providers, no agent-framework lock-in
Tamper-evident audit log Merkle-verified Decision BOM — AGT's strength. Append-only audit_events; cryptographic chaining on the roadmap
Primary buyer Developer / platform engineer CISO / compliance / privacy officer
License / commercial MIT, free; Microsoft-maintained (Azure pull-through) Commercial SaaS or single-tenant deploy
AARM (CSA) conformance Not yet claimed Aligned with AARM v1.0 — see our AARM page for per-requirement status

When does each matter?

Use AGT (alone) when…

  • You ship a developer tool or internal automation agent that does not touch regulated content.
  • Your concern is autonomous agents doing the wrong thing (drop a table, exec a shell, message another agent) — not what they put into the prompt.
  • Your compliance frame is OWASP Agentic Top 10, not HIPAA / SEC / ITAR / GDPR.

Use Containment.AI (with or without AGT) when…

  • Patient data, customer records, source code, or financial material could end up in an LLM prompt.
  • You need real-time redaction — let the agent keep working, but strip the SSN before it reaches OpenAI.
  • You need to govern BYOK / shadow-AI — engineers with personal API keys bypass any SDK governance you ship inside the app.
  • HIPAA, FedRAMP, SEC Rule 17a-4, ITAR, EAR, GDPR Article 32 are in scope.
  • You use more than one LLM provider and need a single policy plane across all of them.
Run both

The clean architecture: AGT governs the agent's behavior inside its process; Containment.AI governs the data crossing the LLM boundary. A first-party AGT adapter — so a single policy decision can route through both layers — is on our roadmap; contact us if you want early access.

Sources

This page is researched, not generated. Primary sources behind every claim above:

We will revise this comparison as AGT releases new versions. If you spot an inaccuracy, email engineering@containment.ai and we'll fix it within one business day.

See it stop a real prompt

30-minute demo. We'll show the proxy intercepting a HIPAA-PHI paste in real time, alongside an AGT-style policy decision in the same flow.

Or email enterprise@containment.ai directly.