docs: sync audit redaction status and framing with current code (#8)

* feat(openshell): add governance skill package and runnable example (microsoft#942)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(typescript): add MCP security scanner and lifecycle management to TS SDK (microsoft#947)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: update SDK feature matrix after parity pass (microsoft#950)

Reflects new capabilities added in PRs microsoft#947 (TS), .NET, Rust, Go:
- TypeScript: MCP security scanner + lifecycle management (was 5/14, now 7/14)
- .NET: Kill switch + lifecycle management (was 8/14, now 10/14)
- Rust: Execution rings + lifecycle management (was 6/14, now 8/14)
- Go: MCP security + rings + lifecycle (was 4/14, now 7/14)

All SDKs now have lifecycle management. Core governance (policy, identity,
trust, audit) + lifecycle = 5 primitives shared across all 5 languages.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: add LIMITATIONS.md - honest design boundaries and layered defense (microsoft#953)

Addresses valid external critique of AGT's architectural blind spots:

1. Action vs Intent: AGT governs individual actions, not reasoning or
   action sequences. Documents the compound-action gap explicitly and
   recommends content policies + model safety layers.

2. Audit logs record attempts, not outcomes: Documents that post-action
   state verification is the user's responsibility today, with hooks planned.

3. Performance honesty: README now notes that <0.1ms is policy-eval only;
   distributed mesh adds 5-50ms. Full breakdown in LIMITATIONS.md.

4. Complexity spectrum: Documents the minimal path (just PolicyEvaluator,
   no mesh/crypto) vs full enterprise stack.

5. Vendor independence: Documents zero cloud dependencies in core,
   standard formats for all state, migration path.

6. Recommended layered defense architecture diagram showing AGT as one
   layer alongside model safety, application logic, and infrastructure.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(docs): rewrite OpenClaw sidecar deployment with working K8s manifests (microsoft#954)

Closes microsoft#952

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat: reversibility checker, trust calibration guide, escalation tests (microsoft#955)

ReversibilityChecker with 4 levels and compensation plans. Trust score calibration guide with weights, decay, thresholds. 19 tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat: AGT Lite — zero-config governance in 3 lines + fix broken quickstart (microsoft#956)

agent_os.lite: govern() factory, sub-ms enforcement, 16 tests. Fixed quickstart that called nonexistent add_rules(). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: bump all runtime versions to 3.1.0 and fix CI lint/test failures (microsoft#957)

- Bump __version__ in 29 Python __init__.py files from 3.0.2 to 3.1.0
- Bump version= in 6 setup.py files from 3.0.2 to 3.1.0
- Bump meter version strings in _mcp_metrics.py
- Bump 9 package.json files from 3.0.2 to 3.1.0
- Bump .NET csproj Version from 3.0.2 to 3.1.0
- Bump Rust workspace Cargo.toml from 3.0.2 to 3.1.0
- Create Go sdk doc.go with version marker 3.1.0
- Fix ruff W292 (missing newline at EOF) in data_classification.py
- Fix CLI init regex to allow dots in agent names (test_init_special_characters)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(openclaw): critical honesty pass — document what works vs what's planned (microsoft#958)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): fix Rust crate packaging - use workspace root with -p agentmesh (microsoft#959)

* fix(openclaw): critical honesty pass — document what works vs what's planned

Server (__main__.py):
- Add --host/--port argparse + env var support (was hardcoded 127.0.0.1:8080)

Dockerfile.sidecar:
- Copy modules/ directory (was missing, causing build failure)
- Use 0.0.0.0 for container binding (127.0.0.1 is wrong inside containers)
- Remove phantom port 9091 (no separate metrics listener exists)

openclaw-sidecar.md — full honesty rewrite:
- Add status banner: transparent interception is NOT yet implemented
- Document actual sidecar API endpoints (health, detect/injection, execute, metrics)
- Fix Docker Compose to use Dockerfile.sidecar (was using wrong Dockerfile)
- Remove GOVERNANCE_PROXY claim (OpenClaw doesn't natively read this)
- Replace fictional SLO/Grafana sections with real /api/v1/metrics docs
- Add Roadmap section listing what's planned vs shipped

openshell.md:
- Remove references to non-existent shell scripts
- Fix python -m agentmesh.server to python -m agent_os.server
- Add note that sidecar doesn't transparently intercept (must call API)
- Replace pip install agentmesh-platform with Python skill library usage

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): fix Rust crate packaging — use workspace root with -p agentmesh

cargo package in a workspace writes .crate files to the workspace root's
target/package/, not the individual crate's directory. The pipeline was
running from the crate subdirectory and couldn't find the output.

Fix: change workingDirectory from packages/agent-mesh/sdks/rust/agentmesh
to packages/agent-mesh/sdks/rust (workspace root) and add -p agentmesh
to all cargo commands to target the specific crate.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(adr): ADR 0005 — Liveness attestation extension for TrustHandshake (microsoft#948)

Proposes liveness attestation as opt-in gate for TrustHandshake. Addresses ghost-agent and ungraceful-handoff gaps from microsoft#772.

Co-authored-by: kevinkaylie <129134148+kevinkaylie@users.noreply.github.com>

* blog: MCP Security — Why Your AI Agent Tool Calls Need a Firewall (microsoft#899)

Co-authored-by: aymenhmaidiwastaken <63942652+aymenhmaidiwastaken@users.noreply.github.com>

* feat: add LotL prevention policy for security measures (microsoft#949)

YAML policy template for Living-off-the-Land detection and prevention.

* feat(examples): add ATR community security rules for PolicyEvaluator (microsoft#908)

15 curated ATR detection rules + sync script. Closes microsoft#901.

* fix(docs): correct npm package name and stale version refs across 21 files (microsoft#960)

- Fix @agentmesh/sdk → @microsoft/agentmesh-sdk in 13 markdown files
  (README, QUICKSTART, tutorials, SDK docs, i18n, changelog)
- Fix broken demo path in agent-os README (agent-os/demo.py → demo/maf_governance_demo.py)
- Remove stale v1.0.0 labels from extension status table
- Bump AGT Version refs 3.0.2 → 3.1.0 in case study templates and
  ATF conformance assessment

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): use ESRP Release for NuGet signing (microsoft#961)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): correct ESRP NuGet contenttype casing (microsoft#962)

* fix(ci): add missing packages to ESRP pipeline and fix Go version tag

Three gaps found during publish verification:

1. PyPI: add agentmesh-marketplace (8th package, was missing from matrix)
2. Rust: build+publish both workspace crates (agentmesh + agentmesh-mcp)
   - Changed from single-crate to workspace build (--workspace)
   - Package loop builds both .crate files
   - Renamed artifact from 'rust-agentmesh' to 'rust-crates'
3. Go: add 'v' prefix to version in doc.go (3.1.0 → v3.1.0)
   - Go module tags require semver with v prefix
   - Pipeline grep expects '// Version: v...' format

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): correct ESRP NuGet contenttype casing — 'NuGet' not 'Nuget'

ESRP Release rejected 'Nuget' with: 'The value provided for
ReleaseContentType property is invalid.' ErrorCode 2254.

ESRP content types are case-sensitive. Fix: 'Nuget' -> 'NuGet'.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): add missing packages to ESRP pipeline and fix Go version tag (microsoft#963)

* fix(ci): add missing packages to ESRP pipeline and fix Go version tag

Three gaps found during publish verification:

1. PyPI: add agentmesh-marketplace (8th package, was missing from matrix)
2. Rust: build+publish both workspace crates (agentmesh + agentmesh-mcp)
   - Changed from single-crate to workspace build (--workspace)
   - Package loop builds both .crate files
   - Renamed artifact from 'rust-agentmesh' to 'rust-crates'
3. Go: add 'v' prefix to version in doc.go (3.1.0 → v3.1.0)
   - Go module tags require semver with v prefix
   - Pipeline grep expects '// Version: v...' format

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): correct ESRP NuGet contenttype casing — 'NuGet' not 'Nuget'

ESRP Release rejected 'Nuget' with: 'The value provided for
ReleaseContentType property is invalid.' ErrorCode 2254.

ESRP content types are case-sensitive. Fix: 'Nuget' -> 'NuGet'.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): use EsrpCodeSigning + dotnet push for NuGet (microsoft#965)

EsrpRelease@11 does not support NuGet as a contenttype — it's for
PyPI/npm/Maven/crates.io package distribution. NuGet packages must be
signed with EsrpCodeSigning@5 first, then pushed with dotnet nuget push.

New flow:
1. EsrpCodeSigning@5 with NuGetSign + NuGetVerify operations (CP-401405)
2. dotnet nuget push with the signed .nupkg to nuget.org

This matches the standard Microsoft NuGet ESRP signing pattern used by
azure-sdk, dotnet runtime, and other Microsoft OSS projects.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(security): upgrade axios to 1.15.0 - CVE-2026-40175, CVE-2025-62718 (microsoft#966)

Critical S360 action items for SFI-ES5.2 1ES Open Source Vulnerabilities.

CVE-2026-40175 (CVSS 9.9): Unrestricted Cloud Metadata Exfiltration
via Header Injection Chain — prototype pollution gadget enables CRLF
injection in HTTP headers, bypassing AWS IMDSv2 session tokens.

CVE-2025-62718: NO_PROXY Bypass via Hostname Normalization — trailing
dots and IPv6 literals skip NO_PROXY matching, enabling SSRF through
attacker-controlled proxy.

Upgraded in 3 packages:
- extensions/copilot: 1.14.0 → 1.15.0
- extensions/cursor:  1.13.5 → 1.15.0
- agent-os-vscode:    1.13.6 → 1.15.0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): resolve ESRP_DOMAIN_TENANT_ID cyclical reference (microsoft#967)

The ADO variable ESRP_DOMAIN_TENANT_ID had a cyclical self-reference,
preventing ESRP authentication across ALL publishing stages (PyPI, npm,
NuGet, crates.io).

Fix: Define MICROSOFT_TENANT_ID as a pipeline-level variable with the
well-known Microsoft corporate tenant ID (72f988bf-..., same default
used by ESRP Release action.yml). This is a public value, not a secret.

Also: NuGet publishing requires Microsoft as co-owner of the package
on NuGet.org. See https://aka.ms/Microsoft-NuGet-Compliance

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: sync audit redaction status and framing with current code

- Update SOC2 mapping to reflect CredentialRedactor now redacts
  credential-like secrets before audit persistence (API keys, tokens,
  JWTs, connection strings, etc.). Remaining gap: non-credential PII
  (email, phone, addresses) not yet redacted in audit entries.
- Replace 'kernel-level enforcement' with 'policy-layer enforcement'
  in README, OWASP compliance, and architecture overview to match the
  existing 'application-level governance' framing in README Security
  section and LIMITATIONS.md.
- Qualify 10/10 OWASP coverage claim in COMPARISON.md with footnote
  clarifying this means mitigation components exist per risk category,
  not full elimination.
- Update owasp-llm-top10-mapping.md LLM06 row for credential redaction.

Addresses doc/code inconsistencies identified in external review.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: kevinkaylie <129134148+kevinkaylie@users.noreply.github.com>
Co-authored-by: Aymen Hmaidi <63942652+aymenhmaidiwastaken@users.noreply.github.com>
Co-authored-by: harshnair75567-cloud <harshnair75567@gmail.com>
Co-authored-by: Adamthereal <imadam4real@gmail.com>

Author: 6 people

.cspell-repo-terms.txt

@@ -55,3 +55,16 @@ syscall
 vnet
 workflow
 workflows
+AKIA
+asyncio
+aymenhmaidiwastaken
+carloshvp
+dataclass
+DOTALL
+findall
+hashlib
+hexdigest
+httpx
+lawcontinue
+Permissioned
+ufeff

.lychee.toml

@@ -34,6 +34,9 @@ exclude = [
     # NIST (intermittent 404s from CI runners)
     "nist\\.gov",
 
+    # Stack Overflow (returns 404 to automated crawlers)
+    "stackoverflow\\.com",
+
     # Microsoft login / auth endpoints (require authentication)
     "login\\.microsoftonline\\.com",
     "portal\\.azure\\.com",

CHANGELOG.md

@@ -196,7 +196,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - **TypeScript SDK full parity** (— PolicyEngine + AgentIdentity) — rich policy evaluation with 4 conflict resolution strategies, expression evaluator, rate limiting, YAML/JSON policy documents, Ed25519 identity with lifecycle/delegation/JWK/JWKS/DID export, IdentityRegistry with cascade revocation. 136 tests passing. (#269)
-- **@agentmesh/sdk 1.0.0** — TypeScript package now publish-ready with `exports` field, `prepublishOnly` build hook, correct `repository.directory`, MIT license.
+- **@microsoft/agentmesh-sdk 1.0.0** — TypeScript package now publish-ready with `exports` field, `prepublishOnly` build hook, correct `repository.directory`, MIT license.
 - **Multi-language README** — root README now surfaces Python (PyPI), TypeScript (npm), and .NET (NuGet) install sections, badges, quickstart code, and a multi-SDK packages table.
 - **Multi-language QUICKSTART** — getting started guide now covers all three SDKs with code examples.
 - **Semantic Kernel + Azure AI Foundry** added to framework integration table.
@@ -254,7 +254,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 pip install agent-governance-toolkit[full]
 
 # TypeScript
-npm install @agentmesh/sdk
+npm install @microsoft/agentmesh-sdk
 
 # .NET
 dotnet add package Microsoft.AgentGovernance

COMMUNITY.md

@@ -20,6 +20,7 @@ Community-written content about agent governance, security, and the toolkit.
 | [Decentralized Identity in Multi-Agent Systems — From Theory to Production](https://dev.to/moltycel/decentralized-identity-in-multi-agent-systems-from-theory-to-production-1oe3) | [@MoltyCel](https://github.com/MoltyCel) | Dev.to |
 | [OWASP Agentic Top 10 — What Every AI Developer Should Know in 2026](https://dev.to/zhangzeyu/owasp-agentic-top-10-what-every-ai-developer-should-know-in-2026-55hi) | [@lawcontinue](https://github.com/lawcontinue) | Dev.to |
 | [EU AI Act for AI Agent Developers: A Practical Compliance Checklist](https://eu-ai-act.ai-mvp.com/2026/04/10/eu-ai-act-compliance-checklist-for-ai-agent-developers/) | [@carloshvp](https://github.com/carloshvp) | ai-mvp.com |
+| [MCP Security: Why Your AI Agents Need a Firewall for Tool Calls](https://dev.to/aymenhmaidi/mcp-security-why-your-ai-agents-tool-calls-need-a-firewall-3h48) | [@aymenhmaidiwastaken](https://github.com/aymenhmaidiwastaken) | Dev.to |
 
 ---
 

INDEPENDENCE.md

@@ -24,7 +24,7 @@ Core paths (`agent_os/`, `agentmesh/`, `agent_hypervisor/`, `agent_sre/`) must f
 | **agentmesh** (Rust) | None — pure crypto + serde | ✅ Independent |
 | **agentmesh-mcp** (Rust) | None — pure crypto + serde | ✅ Independent |
 | **agentmesh** (Go) | None — yaml.v3 only | ✅ Independent |
-| **@agentmesh/sdk** (TypeScript) | None — zero runtime deps | ✅ Independent |
+| **@microsoft/agentmesh-sdk** (TypeScript) | None — zero runtime deps | ✅ Independent |
 | **Microsoft.AgentGovernance** (.NET) | None — YamlDotNet only | ✅ Independent |
 
 ## Adapter Pattern

QUICKSTART.ja.md

@@ -42,7 +42,7 @@ pip install agentmesh-lightning        # RL training governance
 ### TypeScript / Node.js
 
 ```bash
-npm install @agentmesh/sdk
+npm install @microsoft/agentmesh-sdk
 ```
 
 ### .NET
@@ -107,7 +107,7 @@ python governed_agent.py
 `governed_agent.ts` というファイルを作成します。
 
 ```typescript
-import { PolicyEngine, AgentIdentity, AuditLogger } from "@agentmesh/sdk";
+import { PolicyEngine, AgentIdentity, AuditLogger } from "@microsoft/agentmesh-sdk";
 
 const identity = AgentIdentity.generate("my-agent", ["web_search", "read_file"]);
 

QUICKSTART.md

@@ -42,7 +42,7 @@ pip install agentmesh-lightning        # RL training governance
 ### TypeScript / Node.js
 
 ```bash
-npm install @agentmesh/sdk
+npm install @microsoft/agentmesh-sdk
 ```
 
 ### .NET
@@ -145,7 +145,7 @@ python governed_agent.py
 Create a file called `governed_agent.ts`:
 
 ```typescript
-import { PolicyEngine, AgentIdentity, AuditLogger } from "@agentmesh/sdk";
+import { PolicyEngine, AgentIdentity, AuditLogger } from "@microsoft/agentmesh-sdk";
 
 const identity = AgentIdentity.generate("my-agent", ["web_search", "read_file"]);
 

README.md

@@ -30,7 +30,7 @@
 Agent Action ──► Policy Check ──► Allow / Deny ──► Audit Log    (< 0.1 ms)
 ```
 
-**Why it matters:** Prompt-based safety ("please follow the rules") has a [26.67% policy violation rate](BENCHMARKS.md) in red-team testing. AGT's kernel-level enforcement: **0.00%**.
+**Why it matters:** Prompt-based safety ("please follow the rules") has a [26.67% policy violation rate](BENCHMARKS.md) in red-team testing. AGT's policy-layer enforcement: **0.00%**.
 
 ---
 
@@ -70,7 +70,7 @@ result = evaluator.evaluate({"tool_name": "delete_file"})   # ❌ Blocked determ
 <summary><b>TypeScript</b></summary>
 
 ```typescript
-import { PolicyEngine } from "@agentmesh/sdk";
+import { PolicyEngine } from "@microsoft/agentmesh-sdk";
 
 const engine = new PolicyEngine([
   { action: "web_search", effect: "allow" },
@@ -200,9 +200,13 @@ Governance adds **< 0.1 ms per action** — roughly 10,000× faster than an LLM
 |---|---|---|
 | Policy evaluation (1 rule) | 0.012 ms | 72K ops/sec |
 | Policy evaluation (100 rules) | 0.029 ms | 31K ops/sec |
-| Kernel enforcement | 0.091 ms | 9.3K ops/sec |
+| Policy enforcement | 0.091 ms | 9.3K ops/sec |
 | Concurrent (50 agents) | — | 35,481 ops/sec |
 
+> **Note:** These numbers measure policy evaluation only. In distributed multi-agent
+> deployments, add ~5–50ms for cryptographic verification and mesh handshake on
+> inter-agent messages. See [Limitations — Performance](docs/LIMITATIONS.md#3-performance-policy-eval-vs-end-to-end) for full breakdown.
+
 Full methodology: [BENCHMARKS.md](BENCHMARKS.md)
 
 ---
@@ -212,7 +216,7 @@ Full methodology: [BENCHMARKS.md](BENCHMARKS.md)
 | Language | Package | Command |
 |----------|---------|---------|
 | **Python** | [`agent-governance-toolkit`](https://pypi.org/project/agent-governance-toolkit/) | `pip install agent-governance-toolkit[full]` |
-| **TypeScript** | [`@agentmesh/sdk`](packages/agent-mesh/sdks/typescript/) | `npm install @agentmesh/sdk` |
+| **TypeScript** | [`@microsoft/agentmesh-sdk`](packages/agent-mesh/sdks/typescript/) | `npm install @microsoft/agentmesh-sdk` |
 | **.NET** | [`Microsoft.AgentGovernance`](https://www.nuget.org/packages/Microsoft.AgentGovernance) | `dotnet add package Microsoft.AgentGovernance` |
 | **Rust** | [`agentmesh`](https://crates.io/crates/agentmesh) | `cargo add agentmesh` |
 | **Go** | [`agentmesh`](packages/agent-mesh/sdks/go/) | `go get github.com/microsoft/agent-governance-toolkit/sdks/go` |
@@ -253,6 +257,7 @@ See **[SDK Feature Matrix](docs/SDK-FEATURE-MATRIX.md)** for detailed per-langua
 - [API: Agent OS](packages/agent-os/README.md) · [AgentMesh](packages/agent-mesh/README.md) · [Agent SRE](packages/agent-sre/README.md)
 
 **Compliance & Deployment**
+- [Known Limitations](docs/LIMITATIONS.md) — Honest design boundaries and recommended layered defense
 - [OWASP Compliance](docs/OWASP-COMPLIANCE.md) — Full ASI-01 through ASI-10 mapping
 - [Azure Deployment](docs/deployment/README.md) — AKS, AI Foundry, Container Apps
 - [NIST AI RMF Alignment](docs/compliance/nist-ai-rmf-alignment.md) · [EU AI Act](docs/compliance/) · [SOC 2 Mapping](docs/compliance/soc2-mapping.md)
@@ -268,6 +273,8 @@ This toolkit provides **application-level governance** (Python middleware), not
 
 **Production recommendation:** Run each agent in a separate container for OS-level isolation. See [Architecture — Security Boundaries](docs/ARCHITECTURE.md).
 
+> **📖 [Known Limitations & Design Boundaries](docs/LIMITATIONS.md)** — what AGT does *not* do, honest performance numbers for distributed deployments, and the recommended layered defense architecture.
+
 | Tool | Coverage |
 |------|----------|
 | CodeQL | Python + TypeScript SAST |

RELEASE_NOTES_v2.1.0.md

@@ -18,7 +18,7 @@ The toolkit is now a **polyglot governance layer**. All three SDKs have first-cl
 | Language | Package | Install |
 |----------|---------|---------|
 | **Python** | [`agent-governance-toolkit[full]`](https://pypi.org/project/agent-governance-toolkit/) | `pip install agent-governance-toolkit[full]` |
-| **TypeScript** | [`@agentmesh/sdk`](https://www.npmjs.com/package/@agentmesh/sdk) | `npm install @agentmesh/sdk` |
+| **TypeScript** | [`@microsoft/agentmesh-sdk`](https://www.npmjs.com/package/@microsoft/agentmesh-sdk) | `npm install @microsoft/agentmesh-sdk` |
 | **.NET** | [`Microsoft.AgentGovernance`](https://www.nuget.org/packages/Microsoft.AgentGovernance) | `dotnet add package Microsoft.AgentGovernance` |
 
 ### TypeScript SDK Full Parity (1.0.0)
@@ -99,7 +99,7 @@ Full methodology: [BENCHMARKS.md](BENCHMARKS.md)
 pip install agent-governance-toolkit[full]
 
 # TypeScript
-npm install @agentmesh/sdk
+npm install @microsoft/agentmesh-sdk
 
 # .NET
 dotnet add package Microsoft.AgentGovernance

docs/COMPARISON.md

@@ -31,12 +31,14 @@ When evaluating agent security tooling, developers often encounter [NeMo Guardra
 | **Least-privilege capability model** | ✅ | ❌ | ❌ | ❌ | ❌ |
 | **Deterministic pre-execution enforcement** | ✅ < 0.1 ms | ❌ | ❌ | ❌ | ❌ |
 | **Chaos / replay testing** | ✅ | ❌ | ❌ | ❌ | ❌ |
-| **OWASP Agentic Top 10 coverage** | **10 / 10** | ~2 / 10 ¹ | ~1 / 10 ¹ | ~0 / 10 ¹ | ~1 / 10 ¹ |
+| **OWASP Agentic Top 10 coverage** | **10 / 10** ² | ~2 / 10 ¹ | ~1 / 10 ¹ | ~0 / 10 ¹ | ~1 / 10 ¹ |
 | **Framework integrations** | **12+** | 3 (LangChain, NeMo-based, custom) | 2 (LangChain, custom) | N/A (gateway) | N/A (gateway) |
 | **LLM provider routing / caching** | ❌ | ❌ | ❌ | ✅ | ✅ |
 | **Works alongside existing tools** | ✅ | ✅ | ✅ | ✅ | ✅ |
 
 > ¹ **OWASP scoring methodology:** Each tool was assessed against the ten [OWASP Agentic Top 10 (2026)](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/) risk categories. A risk is counted as "covered" only when the tool provides a mitigation that addresses the root cause of that risk category (not merely partial or indirect coverage). Scores for NeMo, Guardrails AI, LiteLLM, and Portkey are approximate because none of those tools publish explicit OWASP Agentic Top 10 mappings; they are based on a good-faith review of each tool's documented capabilities as of early 2026.
+>
+> ² **10/10 means mitigation components exist for each risk category**, not that each risk is fully eliminated. AGT provides application-layer governance — see [Known Limitations](LIMITATIONS.md) for documented gaps including hallucination detection, indirect prompt injection into reasoning, and multi-step workflow correlation.
 
 ---