Microsoft Releases Open Governance Contract for AI Agents

A team built a customer support agent that could look up accounts, draft replies, and issue refunds. Compliance set two rules: refunds above a threshold needed human approval, and account data never reached the reply channel unredacted.

The team followed framework documentation, adding guardrails for tool calls and outputs. However, during quarter-end financial closing, it was discovered that the system had been issuing erroneous refunds exceeding the discretionary customer refund budget.

An incident review found that the approval guard threw an exception on a malformed refund request, but the framework dispatcher caught the error, logged a warning, and executed the refund anyway. The output scanner never saw one egress path because a batch entry point emitted no callback at all.

The team followed instructions, but the instructions were the problem.