Microsoft’s open trust stack ties agent controls to shared traces

At a glance

What this is: This is an analysis of Microsoft’s open trust stack for AI agents, where ASSERT, Agent Control Specification and observability converge on OpenInference as a shared trace layer.

Why it matters: It matters because agent governance breaks down when evaluation, policy enforcement and production monitoring cannot be tied to the same execution evidence across frameworks.

Context

OpenInference is a trace contract for AI applications, which means it standardises the events and metadata that let different tools inspect the same agent execution. The governance problem is fragmentation: evaluation tools, runtime policy engines and observability stacks often see different slices of behaviour, so teams cannot prove that a control worked from test through production. In AI agent programmes, that gap quickly becomes an accountability problem because policy, telemetry and decision evidence are separated.

Microsoft’s announcement uses that same problem space to show why control portability matters. If an agent can move across frameworks while its traces remain readable, then security and platform teams can govern behaviour without rebuilding their process for every runtime. For AI and agentic AI programmes, the practical question is no longer whether a control exists, but whether the evidence of enforcement survives the handoff between evaluation, runtime and observability.

Key questions

Q: How should teams govern AI agents that use tools during evaluation?

A: Treat the agent’s permissions as part of the test itself. If the system can browse, fetch, or modify external resources, reviewers should check whether those actions were necessary, bounded, and policy-compliant. The key governance question is whether the agent used delegated authority in a way you would permit outside the benchmark.

Q: Why do agent governance controls need to sit outside the model?

A: Controls outside the model are easier to review, version and enforce consistently across frameworks. Prompt-only guardrails are brittle because orchestration changes can bypass them or make them hard to audit. External controls also produce evidence of enforcement, which is essential when security teams need to prove how a risky action was blocked or approved.

Q: How do security teams know whether an AI agent followed the right path?

A: They need traces that include tool calls, routing decisions, intermediate model steps and control outcomes, not just final text. A correct answer does not prove safe behaviour if the agent skipped a safeguard or used the wrong tool. The right path is visible only when the full execution chain is captured and replayable.

Q: What does shared telemetry change for AI agent accountability?

A: Shared telemetry makes the agent’s behaviour auditable across evaluation, runtime and production, so governance can rely on evidence rather than assumptions. That improves accountability because the same trace can show what the agent tried, what was blocked and what was allowed. It also makes framework changes less disruptive to control validation.

Technical breakdown

Why a shared trace contract matters for AI agents

A shared trace contract gives evaluators and runtime controls a common view of what the agent actually did, not just what it said. In AI systems, final text output is a weak security signal because it hides tool calls, routing decisions, intermediate model steps and timing. OpenTelemetry-style spans close that gap by turning agent execution into structured evidence. OpenInference applies that pattern to AI applications, so evaluation, policy and observability can all read the same execution path. That makes governance portable across frameworks instead of trapped in framework-specific wrappers.

Practical implication: Use a common trace schema so evaluation and runtime controls can be validated against the same execution evidence.

How ASSERT changes the evaluation model

ASSERT is built around spec-driven testing, which means the team defines expected and forbidden behaviour before generating tests. That is different from scoring free-form outputs after the fact. The important mechanism is that ASSERT consumes traces, so it can judge whether an agent reached the right answer through the right sequence of actions. That matters in agentic systems because a superficially correct output can still come from unsafe tool use, skipped safeguards or improper routing. Evaluation becomes behavioural, not just textual.

Practical implication: Write behavioural specifications that test agent action paths, not only final responses.

Why ACS needs policy outside the model

Agent Control Specification treats guardrails as a portable control contract rather than a prompt fragment or framework hook. It places deterministic rules, classifiers or LLM judges at defined checkpoints such as input, LLM call, state, tool execution and output. Because the contract sits outside the model, it can be reviewed once and applied consistently. The security value comes from separating policy from runtime code while still emitting traceable decisions. That reduces the chance that controls disappear when the agent changes framework or toolchain.

Practical implication: Move high-risk agent rules into an external control layer so policy survives framework changes and is observable in production.

NHI Mgmt Group analysis

OpenInference is the missing governance layer for agent evidence. The article shows that evaluation, enforcement and observability only become durable when they share the same trace contract. Without that contract, teams can claim control coverage in one tool and lose the audit trail in another, which weakens both assurance and incident investigation. Practitioner conclusion: treat trace portability as a governance requirement, not an observability preference.

AI agent control is shifting from prompt guidance to externally enforced policy. ACS matters less as a single control system than as proof that agent governance is moving outside the model boundary. That is the right direction for security teams because controls embedded only in prompts are fragile, hard to audit and easy to bypass through orchestration changes. Practitioner conclusion: govern agent decisions where they are executed, not where they are described.

Trace-based governance creates a new identity question for agents. When the same execution path feeds testing, policy decisions and production monitoring, the agent’s operational identity becomes inspectable in a way that traditional application logs do not support. That intersection of identity, privilege and telemetry is where NHIMG sees the real governance shift. Practitioner conclusion: align agent identity controls with trace evidence, or your policy model will outpace your proof model.

OpenInference gives AI governance teams a named concept worth tracking: the trace contract. The concept is simple but important. If the contract is shared, controls travel with the agent; if it is fragmented, every framework change reintroduces blind spots. Practitioner conclusion: standardise the trace contract before scaling agentic AI beyond a single workflow.

From our research library:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Trace contract governance: AI agent programmes now need a control plane that preserves evidence across evaluation, runtime enforcement and observability. When the evidence chain is broken, teams can no longer prove that an allowed action in testing was the same action observed in production, so policy drift becomes an operational risk.

The practical consequence for platform teams is that agent security cannot be treated as a wrapper around prompts. It has to be designed as a governance system with shared telemetry, externalised controls and replayable traces, and the control evidence has to remain readable as frameworks change.

OpenInference-style telemetry also changes how teams think about agent identity. If the agent’s action trail can be inspected end to end, security and IAM teams can align privilege decisions to actual behaviour instead of relying on static assumptions about what the agent should have been able to do.

For practitioners

• Define a shared agent trace contract Standardise the spans, events and metadata your evaluation, control and observability tools must consume so policy decisions can be compared across environments.
• Test agent behaviour against specifications Write behavioural specs that include allowed tools, prohibited actions and expected routing paths, then use them to generate regression cases.
• Externalise runtime controls Place high-risk checks outside the model at input, tool and output checkpoints so governance survives framework changes and is logged consistently.
• Tie production observability to policy decisions Ensure every block, approval and state transition is emitted as trace data that security and platform teams can review in the same pipeline.

Key takeaways

• AI agent governance becomes materially harder when evaluation, runtime control and observability do not share the same trace evidence.
• OpenInference matters because it lets different tools inspect the same agent execution path instead of separate fragments of behaviour.
• Security teams should treat externalised controls and shared telemetry as prerequisites for auditable agentic AI programmes.

Key terms

• Trace Contract: A shared telemetry format that defines what evidence an AI system must emit during execution. In governance terms, it lets evaluation, runtime controls, and observability operate on the same record instead of separate logs that cannot be reconciled.
• Runtime control: Controls that enforce policy while an AI system is operating, rather than after the fact. For healthcare chatbots, runtime control includes data masking, output filtering, access scoping, and immutable logging so the organisation can defend the interaction itself.
• Spec-Driven Evaluation: A testing approach that measures an AI agent against declared behavioural rules rather than ad hoc expectations. It is useful for identifying failures in tool use, routing, and policy compliance before those failures reach production.
• Agent Governance: Agent governance is the set of policies, controls, and evidence required to manage autonomous software as a non-human identity. It covers consent, tool access, lifecycle review, audit logging, and revocation so that an agent remains bounded as its workflows change.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course, the industry's only accredited NHI security programme, to connect governance, identity and operational control in one programme.