Agent Control Specification (ACS): The Open Standard for AI Agent Governance

At Microsoft Build 2026 on June 2, Microsoft open-sourced the control layer for AI agents. The announcement included two projects: the Agent Control Specification (ACS), a portable runtime control standard, and ASSERT (Adaptive Spec-driven Scoring for Evaluation and Regression Testing), a policy-driven evaluation framework built on Microsoft Research. Together, they form what Microsoft calls an open trust stack for AI agents.

The timing is not coincidental. Enterprises are deploying autonomous agents at scale, modifying financial records, triggering payments, and approving workflows. Security has become the decisive factor in whether agent deployments scale with confidence or stall. Industry surveys from McKinsey, Deloitte, and Gartner consistently rank governance, risk, and security compliance as the top barriers to scaling enterprise AI, ahead of model quality or talent.

On the same day as the Build announcement, Cognizant and CrowdStrike expanded their strategic alliance specifically to "secure the agentic enterprise," bringing the CrowdStrike Falcon platform to Cognizant's AI Factory and managed cybersecurity services. The message from the industry is consistent: agents are moving to production, and governance infrastructure is the gap.

ACS and ASSERT are Microsoft's answer to that gap. But they are only half the picture. To build fully governed agents, off-chain controls need to be paired with on-chain identity and payment authorization. That is where ERC-8004 and x402 complete the stack.

The Agent Governance Gap

The problem ACS and ASSERT solve is specific and painful. Written security policies exist in documents. They do not exist in the runtime that agents actually execute in. Developers improvise: instructions in system prompts, custom checks in application code, classifiers to catch problematic inputs and outputs. These approaches work in isolation but leave companies with fragmented controls that are hard to audit and harder to reuse across frameworks, interfaces, and systems.

The gap has three dimensions. First, controls are scattered across prompts, code, gateways, and frameworks, making it impossible to reason about the security posture of an agent deployment as a whole. Second, evaluating agent safety across changing contexts is hard: an agent that passes tests in development may behave differently in production when facing real inputs. Third, the lack of portable controls makes it risky to move from demo to production because every new environment requires rebuilding the governance layer from scratch.

The result is that most enterprise agent deployments stall in pilot. The rest are stuck in what the industry calls "pilot purgatory," and governance is the primary reason.

ASSERT: Policy-Driven Agent Evaluation

ASSERT is Microsoft's open-source framework for policy-driven agent evaluation, built on a proven Microsoft Research approach. It takes organizational policies and requirements as input, systematically generates targeted evaluation scenarios, and surfaces safety and quality defects before they reach production.

What makes ASSERT different from generic benchmarks is that it is requirements-driven. Instead of testing agents against generic quality metrics, ASSERT converts your specific policies into concrete, measurable evaluations. If your policy says "the agent must not share customer data with external tools," ASSERT generates test cases that probe exactly that boundary. The result is context-specific evaluation tailored to your agent's intended behavior.

ASSERT is also safety-focused in a way that distinguishes it from quality-only evaluation tools. It uses a systematization approach specifically validated for safety evaluation, meaning it is designed to find the edge cases and failure modes that matter for security, not just the average-case quality metrics that benchmarks typically measure.

The framework works across LangChain, CrewAI, LiteLLM, OpenAI, and more. It is not tied to Microsoft Foundry, which matters because many generative AI developers build on multi-framework stacks. CrewAI's open source lead described the developer experience: describe the behavior you care about in YAML, point it at a real agent, and get artifacts back that show not just pass/fail but why the judge made each call. The spec, generated cases, model outputs, judge rationale, and metrics are all inspectable locally.

ASSERT launches with support from CrewAI, Arize AI, LiteLLM, Pipecat, and Pydantic, signaling early ecosystem adoption.

The intended workflow is a loop: run ASSERT to identify defects, apply controls to address those defects, then re-run ASSERT to validate improvement. Before-and-after metrics tell a clear story about whether the controls actually worked.

Agent Control Specification (ACS): Portable Safety Controls

If ASSERT is the evaluation layer, ACS is the enforcement layer. The Agent Control Specification is an open industry standard for placing deterministic safety and security controls at checkpoints throughout agentic workflows. It is part of what Microsoft calls the Agent Governance Toolkit.

The analogy Microsoft uses is deliberate: "ACS is the MCP or A2A of agent safety." Just as Model Context Protocol standardized how agents connect to tools and Agent2Agent standardized how agents communicate with each other, ACS aims to provide one open standard for safety controls that any framework can adopt. Microsoft is providing reference implementations for major platforms.

ACS defines five key validation checkpoints in an agent's lifecycle:

1. Input validation - Check user inputs before the agent processes them
2. LLM validation - Evaluate the model's outputs at reasoning checkpoints
3. State validation - Verify the agent's internal state at transition points
4. Tool execution validation - Inspect tool calls before they execute
5. Output validation - Filter or redact the agent's final response before delivery

A policy can allow an action, block it, redact sensitive information, or escalate to a human for approval. Here is what a simple ACS policy looks like in YAML:

version: "1.0"
name: payment-agent-controls
checkpoints:
  input:
    - classifier: pii-detector
      action: redact
  tool_execution:
    - rule: "amount > 100"
      action: escalate
      approver: human
  output:
    - filter: no-credentials-in-response
      action: block

This policy redacts personally identifiable information from inputs, escalates any payment over $100 for human approval, and blocks outputs that contain credentials. The policy is framework-agnostic: it works whether the agent runs on LangChain, CrewAI, or any other stack that implements ACS.

At each checkpoint, ACS supports deterministic control logic: classifier endpoints that categorize information, LLM judges that evaluate outputs against policies, and custom content filters.

The policies are expressed as standard YAML files. This is a design choice with significant implications: controls become portable (they travel with the agent), versionable (they can be tracked in source control), and auditable (they can be reviewed by security teams independently of the agent's code). A security policy written once can be applied to an agent regardless of whether it runs on LangChain, CrewAI, AutoGen, Semantic Kernel, or any other framework.

ACS launches with a broad ecosystem. Customers including KPMG and Zscaler have endorsed the specification. Partners including Arize AI, Aviatrix, BigSpin, CrewAI, Geordie, HoneyHive, IBM, Monte Carlo, and Obsidian are building integrations and reference implementations. Arize AI's co-founder described the significance: "Every block, every human approval, and every state transition ACS emits lands in Arize alongside the OpenInference trace that produced it, so policy and observability finally travel together."

The Control Loop: ASSERT and ACS Together

ASSERT and ACS are designed to work as a closed loop. Run ASSERT to identify where your agent is failing policy requirements. Use ACS to place the right controls at the right checkpoints to address those failures. Re-run ASSERT to confirm improvement.

This is a continuous trust lifecycle: identify risk, evaluate the agent, apply controls, observe behavior, and improve over time. It moves agent governance from a one-time setup to an ongoing process that evolves as the agent and its environment change.

The loop also addresses one of the hardest problems in agent security: the gap between testing and production. ASSERT can run in pre-production to catch defects, ACS can enforce controls in production, and ASSERT can run again in production to validate that the controls are working. The before-and-after metrics give security teams evidence that the governance layer is functioning.

Where ACS Ends and On-Chain Identity Begins

ACS and ASSERT solve the off-chain governance problem. They give developers portable, auditable control over what agents do at runtime. But there is a class of governance questions that off-chain controls alone cannot answer: Which specific agent performed this action? Was it authorized to do so? Can it spend money? What is its history of behavior?

This is where on-chain identity and payment controls complete the governance stack.

ERC-8004 gives every agent a persistent, on-chain identity. This identity is not a label or a configuration setting. It is a cryptographic credential that the agent can present when requesting authorization to act. When an agent wants to execute a payment, it can prove its identity and its authority through on-chain verification. An agent without valid credentials cannot spend, regardless of what its reasoning process concludes. This identity persists across frameworks, environments, and deployments, which means governance policies can be bound to a specific agent, not just to a specific instance of an agent running in a specific environment.

x402 adds a protocol-level payment authorization layer. Before an agent can pay for a service, the x402 protocol requires a payment authorization. This is not a suggestion or a prompt-level instruction. It is a protocol-level gate that enforces spending rules at the infrastructure level. For multi-agent systems, this means each agent's spending can be capped, audited, and traced to a specific identity.

The combination is powerful. ACS handles the off-chain control plane: input validation, tool control, output filtering, and escalation. ERC-8004 handles the identity plane: who is this agent, and is it authorized? x402 handles the payment plane: can this agent spend, and how much?

Governance Layer	What It Controls	Technology
Input/output validation	What agents see and produce	ACS checkpoints
Tool execution	Which tools agents can call	ACS tool validation
Agent identity	Who is acting	ERC-8004 on-chain registration
Payment authorization	Who can spend and how much	x402 protocol gates
Audit trail	What happened and when	On-chain transaction records + ACS policy logs

AgentLux is designed around this combined model. Agents on the platform can register ERC-8004 on-chain identities, and payments can be routed through x402 authorization. Every transaction produces an on-chain record that traces spending to a specific agent identity. The platform treats governance as a first-class infrastructure concern, not an afterthought.

ACS and ASSERT add the off-chain layer that complements what AgentLux provides on-chain. Teams that adopt ACS-style controls for input validation, tool governance, and output filtering, and pair them with ERC-8004 identity and x402 payment gates, will have a governance stack that covers the full agent lifecycle.

What Developers Should Do Now

The Build 2026 announcements are fresh, and the ecosystem is still forming. But there are concrete steps teams can take today.

Start experimenting with ASSERT to evaluate your agents against your own policies. The framework is open source and works across major agent frameworks. Even before adopting ACS for runtime controls, ASSERT gives you a way to understand where your agents are failing against your security requirements.

Plan for ACS adoption as framework support matures. The specification is designed for portability, which means policies you write today should be reusable as the ecosystem expands. Write your agent governance policies in a framework-agnostic format now so they are ready when ACS support lands in your stack.

Register agent identities on-chain through ERC-8004. If your agents do not have persistent, auditable identities, your governance policies have nothing to bind to. An agent that can operate without identity verification is an agent that cannot be held accountable.

Implement x402 payment gates for any agent that spends money. Prompt-level spending instructions are not sufficient. Protocol-level authorization ensures that spending limits are enforced regardless of what the agent's reasoning process decides.

Think of agent governance as a layered problem. Evaluation (ASSERT) tells you where the risks are. Runtime controls (ACS) enforce policies at execution time. On-chain identity (ERC-8004) ensures every action is attributable. Payment gates (x402) ensure every transaction is authorized. No single layer is sufficient on its own.

Checklist: Building Governed Agents

Before deploying an autonomous agent with spending authority, verify each item:

1. Evaluate against your policies - Use ASSERT or a similar framework to test your agent against your specific security requirements, not generic benchmarks
2. Define control checkpoints - Identify the five ACS checkpoints (input, LLM, state, tool, output) and determine what validation each requires
3. Write portable policies - Express governance rules in framework-agnostic format (YAML) so they travel with the agent
4. Register on-chain identity - Give every agent an ERC-8004 identity that persists across environments
5. Implement payment gates - Use x402 or equivalent protocol-level authorization for any agent that spends money
6. Set spending caps - Hard limits per agent per session that cannot be exceeded regardless of reasoning output
7. Log everything - Both ACS policy decisions and on-chain transactions should produce auditable records
8. Close the loop - Re-run evaluation after applying controls to confirm improvement
9. Plan for evolution - Agent governance is continuous; revisit policies as agents, environments, and threats change

Conclusion

ACS and ASSERT represent the most significant step toward portable, open-source agent governance. Microsoft open-sourcing these projects at Build 2026 signals that agent governance is no longer a niche concern. It is infrastructure.

But off-chain controls are only half the stack. Without on-chain identity, controls have no persistent agent to bind to. Without payment gates, spending authorization lives in prompts instead of protocols. The complete governance stack requires both layers: off-chain evaluation and enforcement (ACS + ASSERT) plus on-chain identity and payment controls (ERC-8004 + x402).

AgentLux is designed for this combined model. Agents can register on-chain identities through ERC-8004. Payments can be routed through x402 authorization. Every action can produce an on-chain audit trail. As ACS and ASSERT mature and gain ecosystem adoption, AgentLux agents will be able to plug into both layers.

The era of production-grade agent governance has started. The teams that build on both off-chain controls and on-chain trust will be the ones that deploy with confidence.

Start building governed agents on AgentLux

---

References:

• TechCrunch: Microsoft offers devs a better way to control AI agent behavior (June 2, 2026)
• Microsoft Foundry Blog: Build agents you can trust across any framework with open evals and a control standard (June 2, 2026)
• Cognizant Press Release: Cognizant and CrowdStrike Expand Strategic Alliance to Secure the Agentic Enterprise (June 2, 2026)
• PANews: Microsoft unveiled seven self-developed models at Build 2026 (June 3, 2026)
• Windows News: Build 2026: Microsoft's Agent-First Platform Beyond Windows (June 2, 2026)