Independent survey · Verified August 2026

The AI agent governance landscape.

Roughly fifty projects claim to control what AI agents may do, using the same three words for very different problems. This survey orders them by institutional backing, tags what each one actually enforces, and separates what ships today from what is still one person's expiring draft.

Maintained by AgentAction, which is listed in the independent tier below. Verified against each project's own repository, license file, and package registry. Inclusion is not endorsement and this is not a ranking. Source and revision history on GitHub

Status

Much of what gets cited in this space has never run. Every entry below carries one of these.

Live
Generally available, in production use
Preview
Vendor-labeled preview or beta. Usable, expect breaking changes
Early
Pre-1.0 or thin adoption. Read the source before depending on it
Draft
A specification with no adopted standing
Concept
A published architecture with no implementation
Dormant
Real code, no meaningful activity in a year or more

01 / What the survey found

Six findings.

  1. 01

    Access control and action authorization are different problems

    The MCP authorization spec is OAuth 2.1 at the transport layer. It authorizes a client to reach a server at scope granularity, it is OPTIONAL, and STDIO transports are told not to use it. Nothing in it evaluates whether a particular call with particular arguments should proceed. ID-JAG, Entra Agent ID, Token Vault, Composio, Arcade, SPIFFE and Clerk AgentPass all answer who the agent is and how it gets a token. Clerk's own spec says the quiet part plainly: ongoing action-level control remains the service's responsibility.

  2. 02

    History-dependent constraints had no home in policy engines, and AWS just changed that

    Cedar, OPA/Rego, CEL and Cerbos have no operators for counts, sums, or time-windowed aggregates over prior events, by design. In August 2026 AWS open-sourced Dogwood, extending Cedar with metric first-order temporal logic. Its reference interpreter says outright it is not for production; the language ships inside Bedrock AgentCore Policy. So the capability is live if you are an AWS customer and a research artifact if you are not.

  3. 03

    The enforcement point sits where the constrained party controls it

    In almost every project, the gate runs inside the agent runtime, SDK, sidecar, or the operator's own gateway. Pomerium and Teleport do hand upstreams a signed JWT verified via JWKS, but the claims are subject, email, groups, roles. They prove who is calling, never what they were authorized to do. DPoP looks like it closes this and does not: it covers HTTP method and URI only, so a transfer of ten dollars and ten million dollars produce identical proofs. Payments is the real exception, and it ships.

  4. 04

    Authorization is not proof of execution, and almost nothing links the two

    Three claims that need to stay distinct get collapsed: that an action was authorized, that it executed, and that the intended outcome occurred within constraints. Pipelock is the honest illustration, carrying verdict, side-effect class and policy hash but no outcome field, and stating in its own spec that the receipt does not prove the action's effects were as described. Outside payments, authorized and happened live in separate systems nobody joins.

  5. 05

    Delegation chains have no adopted standard

    RFC 8693 defines nested act claims as the standard representation of a delegation chain, then directs that prior actors are informational only and are not to be considered in access control decisions. The standard way to represent a chain forbids using it for authorization. MCP's roadmap names sub-agent narrowing as open with its working group still forming. Microsoft AGT does implement monotonic narrowing at scale, but on a proprietary mesh scheme that does not cross organizational boundaries.

  6. 06

    Human approval has no production-grade home at the gateway layer

    Every project doing genuine per-call approve and deny is a desktop or local tool, and several are dormant. MCP Guardian has shipped nothing since April 2025. Microsoft AGT ships an in-memory approval queue by default. Auth0's asynchronous authorization via CIBA is the most production-ready path in the landscape, and it lives in an identity product rather than an agent gateway.

02 / The projects

Ordered by backing, not by preference.

Around fifty projects could appear here. These are the ones that change what you should conclude, one per distinct approach.

Tier 1

Hyperscalers and major public companies

The center of gravity. Between them these set the default policy languages and integration seams for the whole category.

ProjectEnforcesStatusWhy it matters
Agent Governance ToolkitMicrosoftGatePreviewIntercepts every tool call, message and delegation pre-execution. Policy in YAML, Rego or Cedar; SDKs in five languages. The only at-scale implementation of monotonic delegation narrowing, on a proprietary did:mesh scheme. Approvals default to an in-memory queue.
ContextForgeIBMRoute, GateLiveThe largest open-source gateway, GA since May 2026. A tool_pre_invoke plugin can block a call outright, so enforcement is real but plugin-authored: there is no built-in decision point yet.
AP2Google + FIDOReceiptDraft spec, working codeThe counterexample to findings 3 and 4. SD-JWT mandates verified by merchant, PSP and credentials provider against actual cart parameters before settlement, with receipts binding authorization to execution to outcome. Payments only.
Docker MCP GatewayDockerRoute, GateLiveShips inside Docker Desktop. Real pre-execution blocking via a before-exec interceptor where a non-zero exit blocks the call, but you write the policy as a script.
CedarAWS, CNCF SandboxEngineLiveFormally verified authorization language with Lean-proven semantics. The substrate under AgentCore Policy, Microsoft AGT, ToolHive and cMCP. Deliberately stateless.
InvariantSnykGate, ValidateLiveIntercepting proxy evaluating contextual rules on tool calls both before and after execution. The clearest example of semantic, content-aware gating rather than identity or RBAC gating.
DogwoodAWSEngineEarly as OSS, Live in AgentCoreThe most important recent development here, and the sharpest live-versus-theory case. Extends Cedar with temporal logic over prior events. The reference interpreter says it is not for production; the language ships in a GA AWS service.

Tier 2

Foundation-governed

Vendor-neutral governance, which matters when the thing you are adopting sits on the critical path of every agent action.

ProjectEnforcesStatusWhy it matters
agentgatewayLinux Foundation / AAIFGate, RouteLiveRust data plane for MCP, A2A and LLM traffic. CEL policy over MCP method invocations plus ext_authz delegation. Contributed by Solo.io to the Linux Foundation, not CNCF. 300+ contributors.
Envoy AI GatewayCNCF / EnvoyGate, RouteLivev1.0.0 in June 2026. Per-tool authorization policies matched on backend and tool name, filtered by JWT scopes with CEL. Under proposal to move to AAIF as Agent Router.
Open Policy AgentCNCF, GraduatedEngineLiveThe reference general-purpose engine, used for agent authorization by embedding it as the decision point. Has no agent-native primitives.
AuthZEN Authorization API 1.0OpenID FoundationSpecLive, Final Jan 2026The only mature open standard on the action-authorization side. It standardizes the question, not the risk model. Newer drafts targeting MCP tool authorization remain drafts.

Tier 3

Funded private companies

Where most of the practical, deployable per-tool enforcement lives today.

ProjectEnforcesStatusWhy it matters
ToolHiveStacklokGateLiveThe strongest per-tool authorization in open source. Cedar policies evaluate the call before it reaches the server, using tool arguments, JWT claims and MCP annotations such as readOnlyHint and destructiveHint as attributes. No approvals, no receipts.
TeleportTeleportGate, IdentityLiveAllow and deny lists on MCP tools with globs and regex, enforced pre-execution. Mints a signed JWT the upstream verifies via JWKS, carrying identity claims only. AGPL-3.0 core.
PomeriumPomeriumGate, IdentityLiveAn mcp_tool policy criterion matching tool names by exact, prefix, suffix or list, tied to user identity. Same signed-assertion pattern as Teleport, same identity-only limitation.
LiteLLMBerriAIRoute, GateLiveDB-backed budgets per key, user, team and customer with session-level caps, so it is one of the few places durable state actually lives. Two caveats: budgets fail open without a DB connection, and an open issue reports guardrail hooks never firing on the MCP path.
ObotObot AIGate, RouteLiveFilters are the real hook: an MCP filter server or HTTP webhook returns accept, reject or mutate per tool call before execution. The closest thing to a do-it-yourself approval queue.
Auth0 AI SDKsOkta / Auth0Identity, GateLive, SDKs pre-1.0Asynchronous authorization via CIBA plus push notification is the most production-ready human-in-the-loop approval in the landscape.
Clerk AgentPassClerkIdentityDraftShort-lived, single-use, holder-bound passes scoped per task. Included for one sentence in its spec: ongoing action-level control remains the service's responsibility. Not security-audited, not for production. Unrelated to this project despite the name.

Tier 4

Small companies

Smaller teams, and where several of the more interesting ideas are being tried first.

ProjectEnforcesStatusWhy it matters
nonoalways-furtherGateEarlyCapability-based agent runtime with fine-grained policies, Rust, 88 contributors. The largest project in this tier by a wide margin and under-covered relative to its size.
open-edisonEdison WatchGateEarlyDeny by default: unknown tools are rejected outright. Tracks the lethal trifecta of private data access, untrusted content and external comms across a session and blocks once all three are live. One of the few genuinely stateful risk models outside AWS. GPL-3.0.
mcp-context-protectorTrail of BitsGateEarlyTrust-on-first-use pinning of server config, blocking calls when tool descriptions change without approval. This is integrity enforcement, a distinct problem: it answers whether the tool changed, not whether this user may call it.
MCP GuardianEQTY LabGateDormantThe clearest per-call human approve and deny implementation, and the evidence for finding 6: six releases, all between February and April 2025, nothing since.
cMCPAgentTrust.ioGate, ReceiptEarlyEvaluates Cedar policies inside a hardware TEE and emits attested claims, genuinely removing operator trust from the signing path. But the MCP server verifies nothing, and they say so. Well-engineered, essentially unadopted.

Tier 5

Independent and solo-maintained

Everything in this tier is early. Read the source before depending on any of it, including ours.

ProjectEnforcesStatusWhy it matters
PipelockIndependentGate, ReceiptEarlyCapability separation: the agent holds secrets but no network, Pipelock has network but no secrets. Emits mediator-signed receipts verifiable offline with no account or server. Also the most honest artifact in this survey.
AegisIndependentGate, ReceiptEarlyThe most complete single-project feature match to gating plus approvals plus receipts: SDK auto-patching across nine Python frameworks, HTTP and MCP stdio proxies, hash-chained audit with optional Ed25519 signing, kill switch. Backed by an academic paper. Single maintainer.
permit0IndependentGate, ReceiptEarlyNot Permit.io; different org, no affiliation. Its whole thesis is pre-execution adjudication: risk scoring across nine dimensions, session-aware cross-call pattern detection, tier-based routing to human approval, ed25519 audit. Human reviewers can only narrow a decision, never widen it.
agent-passport-systemIndependentIdentity, Gate, ReceiptEarlyNarrowing-only delegation per hop, Ed25519 three-signature chains, cascade revocation, and the only project found putting idempotency at the authorization boundary. Conceptually the most complete design in this tier; its academic framing is self-published, not peer-reviewed.
AgentActionSelf-listed by the maintainerGate, Receipt, IdentityEarly, demos liveGates the exact tool call against policy, approvals, budgets, idempotency and data-flow rules, then issues a JWS authorization receipt with a public JWKS endpoint, plus Express and FastAPI middleware so a receiving service can verify authority before it mutates. Records the provider result and replays it on an identical retry instead of executing twice. Runs as a local TypeScript guard or a hosted runtime with approval queues and scoped single-use grants, and integrates behind Envoy ext_authz and agentgateway ExtMCP rather than replacing them. Solo-maintained and thinly adopted; the enterprise gateway direction on this site is product direction, not shipped.Refund and approval demo Production deploy demo npm: @dinpd/ai-agent-guard

Model and conversation validation is a distinct, well-served category this survey does not try to cover. Guardrails AI is the most adopted, with NeMo Guardrails and Meta Purple Llama as the major vendor entries. They validate content. They do not authorize actions, have no identity model, and no receipt primitive. Comparing them head-to-head with anything above is a category error.

03 / Standards

What is adopted, and what is one person's draft.

IETF individual submissions are frequently quoted as though they were adopted work. Anyone can publish one, they expire after six months, and several of the most-cited here are written by parties selling an implementation.

DocumentBodyStatusWhat it actually is
RFC 8693 Token ExchangeIETFRFCDefines nested act delegation chains, and forbids using prior actors for access control
RFC 9449 DPoPIETFRFCProof of key possession. Covers HTTP method and URI only, not the request body
RFC 9943 SCITTIETFRFCAppend-only transparency over already-signed statements. Notarization, not a pre-execution gate
AuthZEN Authorization API 1.0OpenID FoundationFinalThe enforcement-point to decision-point envelope. The only settled standard on the action side
MCP authorizationAAIFLive specOAuth 2.1 profile at the transport layer. OPTIONAL, HTTP-only
A2A 1.0Linux FoundationLive specAgent interop. No identity primitive, no delegation semantics
OAuth Identity Chaining (ID-JAG)IETFWG adopted, IESG approvedCross-trust-domain token exchange. Identity, not action
Transaction TokensIETFWG consensus, awaiting write-upScoped to a single trust domain by design
COSE ReceiptsIETFWG draftMerkle inclusion proofs. Proves this was logged, not this was authorized
WIMSE workload identityIETFWG drafts, no RFC yetArchitecture stabilizing, nothing normative shipped
AP2Google + FIDODraft, code worksPayment mandates as verifiable credentials. The one place provider-side verification ships
draft-chen agent authz use casesIETFIndividual draftThe grant-layer versus execution-layer gap analysis. Well argued, no standing
draft-schrock EP authorization receiptsIETFIndividual draftProvider-verified action receipts with declared enforcement classes
draft-niyikiza attenuating agent tokensIETFIndividual draft, expires Sept 2026Capability narrowing across delegation hops
draft-reece WIMSE cross-org delegationIETFIndividual draftExplicitly a problem statement. States it does not specify a solution
MCP Agent Identity WGAAIFFormingChartered to address sub-agent authority narrowing
Cloudflare Agent Access ModelCloudflareConceptReference architecture. No implementation, no repository

The pattern is hard to miss: everything settled is about identity and transport, everything about action-bound authority is an individual draft or a concept.

04 / Conclusion

Gating became table stakes. Evidence did not.

At the start of 2026, a policy check in front of the tool call was a differentiator. It is now a feature of Microsoft's toolkit, of every serious MCP gateway, of two identity-aware proxies, and of a managed AWS service.

Cedar and CEL have emerged as the default policy languages, ext_authz as the default integration seam, and per-tool authorization tied to JWT claims as the default shape. Anyone building here should assume the enforcement layer is commoditizing and plan accordingly. The stateful layer moved this month, and the underlying temporal-logic research is fifteen years old and well understood. Expect it to spread.

What has not moved is the evidence layer. Every mature project stops at OpenTelemetry spans and structured logs, which the operator can rewrite. The gateways that do hand a downstream service something signed are attesting identity, not authority. Nothing outside payments links the authorization decision to what actually executed, and nothing constrains authority across a delegation chain in a way a relying party in another organization can verify. Three separate standards efforts have written down some version of this gap in the last six months. All three are individual drafts.

The industry has largely solved “may this agent connect,” is rapidly solving “may this call proceed,” and has barely started on “can anyone else prove what was authorized and what actually happened.”

Choosing something today

Per-tool policy in front of MCP servers, in production now
ToolHive for Cedar with tool arguments as attributes, or agentgateway for CEL under foundation governance
Policy across a mixed estate with SDKs in several languages
Microsoft Agent Governance Toolkit, accepting preview status
Constraints over sequences, budgets, or session history
Bedrock AgentCore Policy if you are on AWS. Otherwise you are assembling durable state yourself
Content validation of model input and output
Guardrails AI, or NeMo Guardrails for conversational rails. Different layer from everything above
Isolation and credential brokering more than policy
Docker MCP Gateway
Protection against tool descriptions changing under you
mcp-context-protector from Trail of Bits
Human approval on individual calls
Nothing production-grade ships this. Auth0 CIBA if you are identity-centric, Obot filters if you are building it yourself
A receiving service that must verify authority itself
AP2 if the domain is payments. Otherwise this is an open problem and every project attempting it is early

The useful question is rarely which tool is best, it is which layer you are missing. Several of these compose cleanly, and the most common mistake in this category is buying a second thing that does what the first thing already did.

What would close the gaps

  1. An interoperable, action-bound authorization receipt a receiving service can verify without a callback and without trusting the caller's infrastructure. AP2 demonstrates the shape; payments assumptions are baked into it.
  2. Execution closure, treating authorized, executed and outcome-achieved as three distinct claims linked by evidence rather than one log line.
  3. Cross-organizational delegation a relying party can verify recursively, which RFC 8693 currently instructs implementers not to attempt.
  4. A server-side approval queue with durable state, expiry and payload binding, as ordinary infrastructure rather than a desktop utility.
  5. Temporal policy outside a single cloud provider, given that the research is settled and only one production implementation exists.

None of these are blocked on invention. They are blocked on someone building the boring, interoperable version and enough parties agreeing to verify it.

Corrections welcome

If your project is missing or mischaracterized, tell us.