# Xilos vs. Microsoft Agent Governance Toolkit — Catch-Up Plan

**Author:** Milly  
**Date:** 2026-08-18  
**Status:** Approved for implementation  
**Audience:** Pete Shimshock (CEO), Eve (engineering)

---

## 1. Executive Summary

Microsoft released the Agent Governance Toolkit (AGT) — an MIT-licensed, 13,000-test, 10/10 OWASP Agentic Top 10 governance framework for autonomous AI agents. It is not a direct Xilos competitor (it doesn't route, cache, or provide a chat UI), but it **raises the floor for what enterprise buyers expect from AI governance**.

Xilos needs to clear that floor. This plan details exactly what changes go into **which version of Xilos** (OSS vs. Cloud), in what order, and why.

**Core thesis:** Don't try to out-Microsoft Microsoft on governance infrastructure. Absorb their concepts, integrate where complementary, and compete on the layer AGT ignores — daily-use chat + routing intelligence + cost savings.

---

## 2. Version Strategy — OSS vs. Cloud

| Feature Area | Goes In | Reasoning |
|-------------|---------|-----------|
| Policy-as-code (YAML) | **OSS** | Core governance primitive. Self-hosters need it to evaluate Xilos. Drives OSS adoption which feeds Cloud conversions. |
| Deterministic tool validation | **OSS** | Same logic — fundamental guardrail, not a premium feature. |
| OWASP compliance mapping | **OSS** | Marketing docs in the repo. Every GitHub visitor sees it. |
| Audit integrity (SHA-256 chain) | **OSS** | Table stakes for any audit log. If it's not tamper-evident, compliance teams ignore it. |
| Framework adapters | **OSS** | Distribution play — we want LangChain users to find `xilos-langchain` on PyPI and naturally adopt Xilos as their gateway. |
| Agent identity (Ed25519) | **Cloud** | Requires key management infra, API key lifecycle, rotation UI. Premium enterprise feature. |
| Compliance dashboard | **Cloud** | Cloud-only UI feature. Ties into billing/plan limits. Upsell surface. |
| SIEM integration | **Cloud** | Webhook-based, needs superadmin config panel, delivery guarantees. Cloud handles the reliability contract. |
| OWASP posture reporting | **Cloud** | Generated compliance PDFs/audit exports. Premium. |
| Multi-tenant policy isolation | **Cloud** | Each org gets isolated policy evaluation. Requires RLS, superadmin oversight. |
| Policy templates library | **Cloud** | Pre-built policies for SOC 2, HIPAA, GDPR. Curated, versioned, audited. |

**Rule of thumb:** If a feature makes the OSS version more attractive to download and try, it goes in OSS. If it requires multi-tenant infra, managed reliability, or is an enterprise upsell, it goes in Cloud.

---

## 3. Phase 1 — Compliance Table Stakes (Ship This Month)

### 3.1 OWASP Agentic Top 10 Mapping

**Target:** xilos-oss

**What:** A markdown file (`docs/compliance/owasp-agentic-top10.md`) in the xilos-oss repo that maps every Xilos feature to the OWASP Agentic Top 10 (2026) risk categories.

**Structure:**

| Risk | Xilos Coverage | Mitigation |
|------|---------------|------------|
| ASI-01 Agent Goal Hijack | ⚠️ Partial | Routing rules + restrictions detect unusual query patterns. **Planned:** Policy-as-code rules that block unauthorized goal changes. |
| ASI-02 Tool Misuse & Exploitation | ✅ Partially covered | Tool validation checks name + params. MCP tool marketplace with audit logging. **Planned:** Deterministic parameter schema enforcement. |
| ASI-03 Identity & Privilege Abuse | ⚠️ Partial | API keys scoped to org/department. **Planned:** Ed25519 per-key identity signatures (Cloud). |
| ASI-04 Agentic Supply Chain Compromise | ❌ | **Planned:** Tool catalog signing and integrity verification (Cloud). |
| ASI-05 Unexpected Code Execution | ⚠️ Partial | Guardrails block suspicious patterns. **Planned:** Deterministic command denylist. |
| ASI-06 Memory & Context Poisoning | ⚠️ Partial | Context engine with versioning. **Planned:** Episodic memory integrity checks. |
| ASI-07 Insecure Inter-Agent Communication | ❌ | **Planned:** Encrypted MCP channels + trust gates. |
| ASI-08 Cascading Agent Failures | ⚠️ Partial | Workflow engine error handling. **Planned:** Circuit breakers on provider failures. |
| ASI-09 Human-Agent Trust Exploitation | ✅ Covered | Full audit trails for every query, governance action logging, dashboard visibility. |
| ASI-10 Rogue Agents | ⚠️ Partial | API key revocation, org-level kill switch. **Planned:** Anomaly detection on call patterns. |

**Files to create:**
- `xilos-oss/docs/compliance/owasp-agentic-top10.md`
- `xilos-oss/docs/compliance/README.md` (index with all compliance docs)

**Estimated effort:** 3-4 hours (documentation only, one-time)

**Who:** Milly

---

### 3.2 Deterministic Policy-as-Code

**Target:** xilos-oss (xilos-engine)

**What:** Add a YAML policy file format that organizations can upload. Policies are evaluated BEFORE any LLM call — deterministic, sub-millisecond, fail-closed.

**Design:**

```yaml
# governance.yaml — org-level
apiVersion: xilos.governance/v1
default_action: allow
rules:
  - name: block-destructive-tools
    condition: tool.name in ["drop_table", "delete_all", "truncate", "shell_exec"]
    action: deny
    reason: "Destructive operations require human approval"

  - name: require-audit-for-external-communication
    condition: tool.name in ["send_email", "post_to_slack", "tweet"]
    action: require_approval
    approvers: ["security-team@org.com"]

  - name: rate-limit-high-cost-models
    condition: model.family == "gpt-4" and user.daily_spend > 50
    action: deny
    reason: "Daily spend cap exceeded for GPT-4"

  - name: block-data-exfiltration
    condition: action.type == "api_call" and target.host not in allowed_domains
    action: deny
    reason: "Data exfiltration blocked"
```

**Changes needed:**

1. **New model:** `GovernancePolicyYAML` — stores the YAML content + version hash per org
2. **New service:** `policy_engine.py` — parses YAML, evaluates conditions, returns `allow`/`deny`/`require_approval`
3. **New router:** `POST /api/v1/governance/policy` — upload/validate YAML
4. **Middleware integration:** Policy check fires as middleware on every chat completion + tool call
5. **Migration:** Existing `GovernancePolicy` model (PII/HAP/jailbreak toggles) still works — YAML policies layer on top

**Implementation details:**

- Use `PyYAML` for parsing (already in deps or add it)
- Condition evaluator: simple expression engine (parse `tool.name in [...]`, `user.daily_spend > 50`). Start with safe eval using a restricted Python-like DSL, not full arbitrary execution
- Default action configurable per org (`allow` or `deny`)
- Policy validation endpoint runs the YAML through a dry-run evaluator
- Store policy version; increment on every update

**Files to create/modify (xilos-oss/xilos-engine/):**

| File | Action |
|------|--------|
| `models/governance_policy_yaml.py` | Create — SQLModel for YAML storage |
| `services/policy_engine.py` | Create — YAML parser + condition evaluator |
| `routers/governance.py` | Modify — add policy CRUD endpoints |
| `middlewares/governance.py` | Create — pre-request policy evaluation middleware |
| `middlewares/__init__.py` | Modify — register middleware |
| `requirements.txt` / `pyproject.toml` | Add `pyyaml` if missing |

**Estimated effort:** 2-3 days engineering (Eve)

**Why OSS:** Every self-hoster needs deterministic policies. This is what makes Xilos a governance platform, not just a proxy. If you only put this in Cloud, OSS users will dismiss Xilos as "not real governance."

---

### 3.3 Deterministic Tool Validation (with Schema Enforcement)

**Target:** xilos-oss

**What:** Currently `validate_tool_call` checks the tool name against an allowed list and validates JSON. Upgrade it to enforce parameter schemas — if a tool declares it expects `{email: string}`, and an agent calls it with `{sql: "DROP TABLE"}`, block it before it reaches the LLM response parser.

**Changes needed:**

1. Define parameter schemas per tool in the tool catalog (JSON Schema format)
2. Add schema validation to `services/governance_evaluators.py` — before the LLM's tool call is dispatched
3. Return a structured `GovernanceDenied` response that the UI can display

**Current code:** `services/governance_evaluators.py` line 49-77 — basic name check only.

**Files to modify:**

| File | Change |
|------|--------|
| `services/governance_evaluators.py` | Add `validate_tool_parameters()` with JSON Schema support |
| `models/tool.py` | Add `parameters_schema` field (may already exist via `parameters` field) |
| `services/tool_executor.py` | Call parameter validation before execution |

**Estimated effort:** 4-6 hours

---

### 3.4 Audit Integrity (SHA-256 Chain)

**Target:** xilos-oss

**What:** Add a `previous_hash` field to the `AuditLog` model. Each new audit entry includes `SHA256(previous_entry_id + previous_entry_hash + action + timestamp)`. Tampering with any entry breaks the chain for all subsequent entries.

**Implementation:** Append-only. If an entry is deleted, the next entry's `previous_hash` won't match. Detection is a single SQL query.

**Changes needed:**

| File | Change |
|------|--------|
| `models/audit_log.py` | Add `previous_hash: str` field, auto-compute on insert |
| `services/audit_service.py` (or equivalent) | Compute hash, verify chain on read |
| New: `cli/verify_audit_chain.py` | CLI tool to verify integrity |

**Estimated effort:** 2-3 hours

---

## 4. Phase 2 — Parity Where It Matters (Next 60 Days)

### 4.1 Framework Adapters (LangChain + AutoGen)

**Target:** xilos-oss (separate PyPI packages)

**What:** Two lightweight Python packages that integrate Xilos governance into popular agent frameworks.

**`xilos-langchain`:**
- LangChain callback handler that routes all tool calls through Xilos governance
- Auto-discovers the Xilos endpoint from env var `XILOS_BASE_URL`
- ~300 lines of Python

**`xilos-autogen`:**
- AutoGen plugin that wraps the `Tool` class to check Xilos governance before execution
- Same env var pattern

**Distribution:** PyPI packages, mentioned in xilos-oss README, linked from docs.

**Files to create:**

```
xilos-oss/
  adapters/
    langchain/
      README.md
      pyproject.toml
      xilos_langchain/
        __init__.py
        callback.py
        handler.py
    autogen/
      README.md
      pyproject.toml
      xilos_autogen/
        __init__.py
        tool_wrapper.py
        plugin.py
```

**Estimated effort:** 1 week (both adapters)

---

### 4.2 Policy Evaluation Middleware (System-Wide)

**Target:** xilos-oss

**What:** Currently governance checks fire per-route (chat completions, tool calls). Move policy evaluation into the **FastAPI middleware chain** so every API request — regardless of route — goes through policy evaluation.

This catches edge cases where an API key is used from a custom integration or a non-standard client.

**Implementation detail:** The middleware reads the bearer token, resolves the organization, loads their YAML policy, and applies it to the request context. Downstream routes can query the policy verdict instead of re-evaluating.

**Files to modify:**

| File | Change |
|------|--------|
| `middlewares/auth.py` | Add policy context to request state |
| New: `middlewares/policy.py` | Policy evaluation middleware |
| `app/main.py` | Register policy middleware |
| Individual routers | Remove per-route governance checks (redundant) |

**Estimated effort:** 1 day

---

### 4.3 Agent Identity (Ed25519 per API Key)

**Target:** xilos-cloud only

**What:** Every API key gets an Ed25519 key pair. Agents sign every request with their private key. Xilos verifies the signature before processing.

This answers the enterprise question: "Which agent did this?" Currently, five agents can share one API key and be indistinguishable in audit logs.

**Changes needed (cloud/):**

| File | Change |
|------|--------|
| `cloud/superadmin/superadmin_keys.py` | Add key pair generation on API key creation |
| New: `xilos-oss/xilos-engine/services/identity.py` | Ed25519 signature verification |
| `middlewares/auth.py` | Verify request signature alongside bearer token |
| `models/user_auth_tokens.py` | Add `public_key` field |

**Client-side:** Provide `xilos-auth` helper package that signs requests:

```python
from xilos_auth import SignedClient

client = SignedClient(
    api_key="sk-xilos-...",
    private_key="ed25519:...",
    base_url="http://localhost:8000/api/v1"
)
# Every request is now signed
```

**Estimated effort:** 3-4 days

---

## 5. Phase 3 — Flip the Narrative (90 Days)

### 5.1 Compliance Dashboard

**Target:** xilos-cloud (xilos-ui/cloud/)

**What:** A dashboard tab in the Xilos UI showing:

- OWASP Agentic Top 10 posture (green/yellow/red per category)
- Policy violation timeline (blocked vs. flagged vs. passed)
- Enforcement breakdown by type (PII, jailbreak, tool misuse, policy rules)
- Audit log integrity status (chain valid/broken)
- Export compliance report (PDF)
- Policy coverage score

**UX mock:**

```
┌─────────────────────────────────────────────────────┐
│  Compliance Overview                        [Export] │
├─────────────────────────────────────────────────────┤
│  OWASP Agentic Top 10        │  Audit Integrity     │
│  ┌───────────────────────┐   │  ┌────────────────┐  │
│  │ ASI-01  ████████░░ 80%│   │  │ Chain: ✅      │  │
│  │ ASI-02  ██████░░░ 65%│   │  │ Entries: 12,847 │  │
│  │ ASI-03  ████░░░░░ 42%│   │  │ Last verified:  │  │
│  │ ...                   │   │  │ 5 min ago       │  │
│  └───────────────────────┘   │  └────────────────┘  │
├──────────────────────────────┴──────────────────────┤
│  Policy Enforcement (Last 30 Days)                   │
│  ┌──────────────────────────────────────────────────┐│
│  │ ████████████████████████ Passed   12,420  84%   ││
│  │ ████████                   Blocked   1,892  13%  ││
│  │ ██                         Flagged    444   3%   ││
│  └──────────────────────────────────────────────────┘│
└─────────────────────────────────────────────────────┘
```

**Files to create/modify:**

- `xilos-oss/xilos-ui/src/pages/Governance/ComplianceDashboard.tsx` (new)
- `xilos-oss/xilos-ui/src/pages/Governance/PolicyEditor.tsx` (new — YAML editor with validation)
- `cloud/` — superadmin compliance overview

**Estimated effort:** 2 weeks frontend, 1 week backend

---

### 5.2 SIEM Integration

**Target:** xilos-cloud

**What:** Structured log export for Splunk, Microsoft Sentinel, and generic webhook targets.

**Supported formats:**
- Splunk HEC (HTTP Event Collector) — JSON
- Microsoft Sentinel / Log Analytics — OTel compatible
- Generic webhook — arbitrary POST with configurable payload template

**Changes needed:**

| File | Change |
|------|--------|
| `services/siem_exporter.py` | Enhance to support multiple output formats |
| `models/siem_webhook.py` | Add format selector, batch config, retry policy |
| `routers/siem_webhooks.py` | Add config UI endpoints |
| UI | Add SIEM configuration panel |

**Estimated effort:** 4-5 days

---

### 5.3 Policy Templates Library

**Target:** xilos-cloud

**What:** Curated, pre-built policy templates for common compliance frameworks:

- **SOC 2:** Audit-all, block-destructive, user-access-control
- **HIPAA:** PHI-blocking, audit-all, minimum-necessary-access
- **GDPR:** Data-minimization, right-to-erasure logging, consent-check
- **PCI-DSS:** Card-data-blocking, access-control, audit-all
- **Custom:** SOC reports, export-ready compliance packs

Each template is a YAML file with annotations explaining what each rule does and which compliance requirement it maps to.

**Files to create:**

```
xilos-oss/docs/policy-templates/
  soc2.yaml
  hipaa.yaml
  gdpr.yaml
  pci-dss.yaml
  README.md
```

**Cloud feature:** One-click apply from template library in the UI.

**Estimated effort:** 1 week

---

## 6. Things Deliberately Not Building

| Feature | In AGT? | Why Skip |
|---------|---------|----------|
| Execution sandboxing (privilege rings) | ✅ | Docker containers handle this. Xilos' job is to block bad calls before they reach the sandbox. |
| SPIFFE identity federation | ✅ | Overkill. Ed25519 per API key is the right abstraction for Xilos' use case. |
| RL training governance | ✅ | Microsoft trains models. MPR doesn't. Zero customer demand. |
| Full SRE framework (SLOs, error budgets) | ✅ | Circuit breakers on ailing providers? Yes. Full SRE dashboard? Not until a customer asks for it. |
| Shadow AI discovery (scan for unregistered agents) | ✅ | Cool feature, zero revenue impact for an 8-person company targeting SMBs. |
| Chaos testing for agents | ✅ | Not today. Maybe never. |
| Post-quantum signing (ML-DSA-65) | ✅ | On their roadmap. Cute. Not a sales blocker. |
| Merkle tree audit logs | ✅ | SHA-256 chain gives 95% of the tamper-evident value at 5% of the complexity. |

---

## 7. Implementation Timeline

```
Week 1    ████████░░░░░░░░░░░░  OWASP mapping + Audit integrity + Deterministic tool validation
Week 2    ████████████░░░░░░░░  Policy-as-code (YAML engine + middleware + CRUD)
Week 3    ████████████████████  Policy evaluation middleware + Framework adapters (LangChain)
Week 4    ████████████████████  Framework adapters (AutoGen) + xilos-auth helper
          ─── Phase 1/2 Complete ───
Week 5-6  ████████████████████  Agent Identity (Ed25519) — Cloud only
Week 7-8  ████████████████████  Compliance Dashboard — Cloud only
Week 9    ████████████████████  SIEM integration + Policy templates
Week 10   ████████████████████  Polish, docs, marketing site update
          ─── Phase 3 Complete ───
```

**Key milestones:**
- **End of Week 2:** Deterministic policy enforcement is live. Axos demo shows "this tool call was structurally impossible, not LLM-advised against."
- **End of Week 4:** OSS users can `pip install xilos-langchain` and get governed agent calls. OSS adoption narrative becomes "the open-source AI gateway with enforceable governance."
- **End of Week 10:** Cloud customers get a compliance dashboard that replaces 2-3 SaaS tools. Xilos is now a governance platform with a routing engine, not a routing engine with guardrails bolted on.

---

## 8. How This Changes the Pitch

### Before AGT

> "Xilos is an AI gateway. Change one `base_url` and get routing, caching, guardrails, and cost tracking. Save 50% on your AI bill."

### After AGT / After This Plan

> "Xilos is the intelligence layer for organizations that want to own their AI. Every model, every user, every call — governed through one gateway. Multi-model routing to reduce costs by 50%. Semantic caching to cut latency. Deterministic policy enforcement that makes prohibited actions structurally impossible. OWAS P Agentic Top 10 covered. Self-hosted or managed cloud. **Microsoft's governance toolkit is a great SDK. Xilos is a product your employees will actually use.** "

---

## 9. Appendix: File Manifest by Version

### xilos-oss (Open Source — BSL 1.1)

```
NEW:
  docs/compliance/owasp-agentic-top10.md
  docs/compliance/README.md
  docs/policy-templates/README.md
  docs/policy-templates/soc2.yaml
  docs/policy-templates/hipaa.yaml
  docs/policy-templates/gdpr.yaml

  xilos-engine/models/governance_policy_yaml.py
  xilos-engine/services/policy_engine.py
  xilos-engine/services/audit_service.py
  xilos-engine/middlewares/governance.py
  xilos-engine/middlewares/policy.py
  xilos-engine/cli/verify_audit_chain.py

  adapters/langchain/ (directory with full package)
  adapters/autogen/ (directory with full package)

MODIFY:
  xilos-engine/models/audit_log.py — add previous_hash field
  xilos-engine/services/governance_evaluators.py — schema enforcement
  xilos-engine/services/tool_executor.py — call new validation
  xilos-engine/routers/governance.py — policy YAML CRUD
  xilos-engine/app/main.py — register new middleware
  xilos-engine/middlewares/auth.py — pass org context
```

### xilos-cloud (Private — Managed SaaS)

```
NEW:
  cloud/dashboard/compliance/ (dashboard components)
  cloud/dashboard/policy-editor/ (YAML editor UI)
  cloud/api/siem/ (SIEM config endpoints)
  cloud/api/identity/ (Ed25519 key management)

MODIFY:
  cloud/superadmin/superadmin_keys.py — add key pair generation
  xilos-engine/models/user_auth_tokens.py — add public_key field
  xilos-engine/middlewares/auth.py — signature verification
  cloud/billing/billing.py — tie compliance dashboard to plan tier
```

---

*End of document. Ready for implementation assignment.*