@microsoft/agent-governance-sdk TypeScript API Reference

const result = await client.executeWithGovernance('data.read', {
  userId: 'alice',
  department: 'engineering',
});

console.log(result.decision);       // 'allow' | 'deny' | 'review'
console.log(result.trustScore);     // TrustScore object
console.log(result.auditEntry);     // AuditEntry with hash chain
console.log(result.executionTime);  // ms

client.identity   // AgentIdentity — Ed25519 DID
client.trust      // TrustManager
client.policy     // PolicyEngine
client.audit      // AuditLogger
client.lifecycle  // LifecycleManager
client.ringEnforcer // RingEnforcer
client.killSwitch   // KillSwitch | undefined

engine.evaluate('data.read');                        // 'allow'
engine.evaluate('data.write', { role: 'admin' });   // 'allow' (conditions match)
engine.evaluate('data.write', { role: 'viewer' });  // 'deny' (conditions don't match)
engine.evaluate('unknown');                          // 'deny' (default)

const result = engine.evaluatePolicy(
  'did:agentmesh:analytics-agent:abc123',
  { user: { role: 'admin' }, action: 'data.write' }
);

console.log(result.allowed);       // true
console.log(result.action);        // 'allow'
console.log(result.matchedRule);   // 'admin-full-access'
console.log(result.policyName);    // 'data-access-policy'
console.log(result.rateLimited);   // false
console.log(result.approvers);     // [] or ['did:...']
console.log(result.evaluationMs);  // 0.123

const policy = engine.loadYaml(`
apiVersion: governance.toolkit/v1
name: data-access-policy
agents:
  - 'did:agentmesh:analytics-*'
scope: tenant

rules:
  - name: admin-full-access
    condition: "user.role == 'admin'"
    ruleAction: allow
    priority: 100

  - name: rate-limit-writes
    condition: "action == 'data.write'"
    ruleAction: allow
    priority: 75
    limit: '100/hour'

  - name: require-approval-for-delete
    condition: "action == 'data.delete'"
    ruleAction: require_approval
    priority: 90
    approvers:
      - 'did:agentmesh:security-team'

default_action: deny
`);

import { PolicyConflictResolver, ConflictResolutionStrategy, PolicyScope } from '@microsoft/agent-governance-sdk';

const resolver = new PolicyConflictResolver(ConflictResolutionStrategy.MostSpecificWins);

const result = resolver.resolve([
  { action: 'allow', priority: 50, scope: PolicyScope.Global, policyName: 'global', ruleName: 'allow-reads', reason: '...', approvers: [] },
  { action: 'deny',  priority: 50, scope: PolicyScope.Agent,  policyName: 'agent',  ruleName: 'deny-untrusted', reason: '...', approvers: [] },
]);

console.log(result.winningDecision.action);  // 'deny' — Agent scope is more specific
console.log(result.strategyUsed);            // 'most_specific_wins'
console.log(result.conflictDetected);        // true

engine.loadJson(jsonContent)          // Load from JSON string
await engine.loadFromYAML('./policy.yaml')  // Load from file
engine.getPolicy('name')              // Get a loaded policy
engine.listPolicies()                 // List all policy names
engine.removePolicy('name')           // Remove by name
engine.clearPolicies()                // Clear all
engine.addRule(rule)                  // Append a flat rule
engine.getRules()                     // Get flat rules snapshot
engine.registerBackend(backend)       // Register external backend (OPA/Cedar)

const message = new TextEncoder().encode('Transfer $500 to account 1234');

// Sign with private key
const signature = agent.sign(message);   // Uint8Array (64 bytes)

// Verify with public key
const valid = agent.verify(message, signature);  // true

// Tampered data fails
const tampered = new TextEncoder().encode('Transfer $50000 to account 9999');
agent.verify(tampered, signature);  // false

agent.isActive()     // true — active and not expired
agent.status         // 'active' | 'suspended' | 'revoked'

agent.suspend('Under investigation')  // active → suspended
agent.reactivate()                    // suspended → active
agent.revoke('Compromised')           // active/suspended → revoked (permanent)

// Expiry check
agent.hasCapability('crm.read')   // true
agent.hasCapability('crm.*')      // true (wildcard match)
agent.hasCapability('admin')      // false

const parent = AgentIdentity.generate('orchestrator', ['data.read', 'data.write', 'admin']);

// Child gets narrowed capabilities — never more than parent
const child = parent.delegate('data-worker', ['data.read', 'data.write'], {
  description: 'Scoped worker',
  sponsor: 'pipeline-team@contoso.com',
});

console.log(child.parentDid);          // parent's DID
console.log(child.delegationDepth);    // 1
console.log(child.hasCapability('admin'));  // false — not delegated

// Export public JWK (RFC 7517)
const jwk = agent.toJWK(false);
// { kty: 'OKP', crv: 'Ed25519', x: '...', kid: 'did:agentmesh:...' }

// Export private JWK (for secure storage only)
const jwkPrivate = agent.toJWK(true);

// JWKS set
const jwks = agent.toJWKS(false);  // { keys: [...] }

// Import
const fromJwk  = AgentIdentity.fromJWK(jwk);
const fromJwks = AgentIdentity.fromJWKS(jwks, agent.did);

// W3C DID Document
const didDoc = agent.toDIDDocument();
// { '@context': [...], id: 'did:agentmesh:...', verificationMethod: [...] }

// JSON serialization (private key excluded)
const json     = agent.toJSON();
const restored = AgentIdentity.fromJSON(json);

tm.recordSuccess('peer-1');        // +0.05 (default reward)
tm.recordSuccess('peer-1', 0.1);   // +0.10 (custom reward)
tm.recordFailure('peer-1');        // -0.10 (default penalty)
tm.recordFailure('peer-1', 0.2);   // -0.20 (harsher penalty)

const score = tm.getTrustScore('peer-1');

console.log(score.overall);                  // 0.55 (0–1, 3 decimals)
console.log(score.tier);                     // 'Provisional'
console.log(score.dimensions.reliability);   // success ratio
console.log(score.dimensions.consistency);   // running score

// Verify peer identity + initial trust
const result = await tm.verifyPeer('remote-agent', peerIdentity);
console.log(result.verified);    // true / false
console.log(result.trustScore);  // TrustScore
console.log(result.reason);      // failure reason if any

logger.verify()  // true — all hashes consistent

// Filter queries
logger.getEntries({ agentId: 'agent-1' })
logger.getEntries({ action: 'data.read' })
logger.getEntries({ since: new Date('2025-01-01') })
logger.getEntries({ agentId: 'agent-1', action: 'data.read', since: new Date() })

console.log(logger.length)   // number of stored entries
console.log(logger.exportJSON())  // full log as JSON string

import { KillSwitch } from '@microsoft/agent-governance-sdk';

const ks = new KillSwitch({ enabled: true, defaultSubstituteAgentId: 'standby-agent' });

// Register termination callback
ks.registerHandler('did:agentmesh:worker:abc', async (agentId, ctx) => {
  console.log(`Terminating ${agentId}: ${ctx.reason}`);
});

// Register compensation (undo work)
ks.registerCompensation('did:agentmesh:worker:abc', async (agentId, ctx) => {
  await rollbackPendingTransactions(agentId);
});

// Register failover
ks.registerSubstitute('did:agentmesh:worker:abc', 'did:agentmesh:standby:xyz');

// Trigger termination
const result = await ks.kill('did:agentmesh:worker:abc', {
  action: 'data.write',
  reason: 'Trust score below threshold',
});

console.log(result.killedAt);             // ISO 8601
console.log(result.callbacksExecuted);    // 1
console.log(result.compensationsExecuted);// 1
console.log(result.handoffAgentId);       // 'did:agentmesh:standby:xyz'

ks.getHistory()  // KillSwitchResult[]