In April 2026 Microsoft released the Agent Governance Toolkit — AGT — as open source, MIT-licensed. At the time, Wytness ran on signing and hash-chain code we had written ourselves. We retired our own machinery and rebuilt on AGT. That sounds like a hard call. It was the easiest decision we've made.
Evidence wants a standard, not a vendor
An audit trail is a strange product: its whole value is that people who don't trust you believe it. The more proprietary the format, the more the trail depends on the vendor who invented it — you're asked to trust the referee and the company that built the referee. A widely adopted, openly specified format breaks that circularity. When the hash chain your auditor is checking is the same MIT-licensed mechanism anyone can read on GitHub, the question "but why should I trust Wytness's chain?" disappears. It isn't Wytness's chain. It's a public standard we record onto.
Play the alternative forward and the argument makes itself. It's 2029. An auditor is reviewing events recorded in 2026. If those events sit in a proprietary format, the verification story depends on one company still existing, still maintaining that format, and still being trusted by whoever is asking. If they sit on an open standard, the verification story is a public specification and published verification code. Evidence with a seven-year life should not have a single point of failure — especially not when the single point of failure would be us.
What AGT does, and does well
AGT runs inside your agent code. Every tool call is policy-checked, allowed or denied, and written to a hash-chained audit log under a cryptographic agent identity. Out of the box that gives everyone — us included — agent identity and delegation chains, a tamper-evident log per agent, fast policy evaluation, and prompt-injection and tool-poisoning detection mapped to the OWASP Agentic Top 10. That is serious infrastructure, maintained by Microsoft, free forever under MIT.
Could we have rebuilt it privately? Sure — we had built parts of it privately, and our versions worked. But "works" was never the bar. Every line of proprietary crypto is a line you must defend in every security review, forever, alone. The same mechanism as an open standard is defended by public scrutiny, Microsoft's maintenance, and a growing ecosystem of people who can read it. Keeping our own version alive would have been vanity engineering: more code for us to defend, with less credibility than the standard.
What a standard doesn't give you
AGT is a kernel, not a product. It has no dashboard — Microsoft's answer for visualisation is Application Insights, which is fine for engineers and useless for a compliance officer. It has no customer-held keys, no per-event signing, no Evidence Packs, no hosted service. That gap is where Wytness lives:
- Ledger inherits AGT's hash-chained log and adds per-event signing with your key, PII sealing with your key, Bring Your Own Storage, and Evidence Pack generation.
- Registry inherits AGT's identity and trust model and adds the hosted dashboard, tool inventory, session correlation, and anomaly rules.
- Shield inherits AGT's policy engine and adds a policy authoring UI, approval routing, and observe-mode tooling.
Built on Microsoft. Not locked to Microsoft.
This is the part people double-check. AGT is Microsoft's code, but it is MIT-licensed and runs wherever your agents run — AWS, GCP, on-prem, anywhere. Adopting it doesn't tie you to Azure, and it doesn't tie you to us: the toolkit is free, and if you only want the kernel, you can run it alone. Wytness is for the moment you need what the kernel doesn't do — the dashboard, the customer-held keys, the exports an auditor accepts. Either path is real, and we say so on the Built on AGT page — including a feature-by-feature table of what needs the wrapper and what doesn't.
"What if Microsoft changes it?"
The other question people ask, and it deserves a straight answer. We don't ride the head of the repository: the Wytness SDKs pin specific, tested AGT releases, and we validate a new release before moving to it — so an upstream change reaches you as a deliberate, tested upgrade, not as a surprise. And the MIT licence is the backstop that makes the whole bet safe: the code as it exists today can never be taken away, relicensed out from under you, or discontinued retroactively. The worst case for an abandoned open standard is that it stops improving. The worst case for a proprietary format is that it stops existing. We know which risk we'd rather carry seven-year evidence on.
The trade-off, stated plainly
Building on someone else's kernel means tracking their releases and living with their design decisions. We accept that happily, for one reason: the alternative is asking customers to bet seven-year evidence on our private format. An MIT-licensed standard cannot be taken away, and will be legible to auditors long after any single vendor's format is forgotten. For a company whose product is trust, standing on the standard was never really a choice.
Questions about how the layers fit together? Ask us.