Microsoft’s open trust stack ties agent controls to shared traces

At a glance

What this is: This article argues that OpenInference is the key layer connecting Microsoft’s ASSERT evaluations, ACS runtime controls, and production observability for AI agents.

Why it matters: It matters because IAM, PAM, and AI governance teams need controls that can be reviewed once, enforced consistently, and audited across the full agent lifecycle.

👉 Read Arize’s analysis of Microsoft’s open trust stack and OpenInference

Context

AI agent governance fails when evaluation, runtime control, and observability live in separate systems. If a team cannot prove what an agent called, what policy blocked it, and what trace evidence supports the decision, it is relying on partial visibility rather than governable control. This article is about that control gap, and the primary identity question is how to treat an agent’s tool use, state changes, and access decisions as auditable security events rather than application noise.

OpenTelemetry-style trace contracts change the governance model because they make agent behaviour observable across frameworks. For identity and security teams, that means policy enforcement can move closer to runtime decisions while still preserving evidence for investigation, review, and regression testing. The article’s starting point is typical for emerging agent stacks: teams have tooling, but not yet a unified control plane for proving how agents behaved.

Key questions

Q: What breaks when AI agent access decisions are handled in prompts?

A: Prompt-based access control is fragile because it places security logic inside the same system attackers are trying to influence. That makes policy easier to manipulate than an external authorization layer. When the model owns the decision path, organisations lose a clear boundary for audit, enforcement, and separation of duties.

Q: Why do shared traces matter for AI agent security teams?

A: Shared traces matter because they connect behaviour, control decisions, and production evidence in one record. That lets teams compare the agent’s test-time failures with its runtime actions and spot policy drift quickly. It also supports accountability when an agent touches tools, state, or delegated access.

Q: How should organisations govern external tools used by AI agents?

A: Organisations should review external tools as security inputs, not convenience features. Each tool needs ownership, approval, metadata inspection, and ongoing monitoring for hidden instructions or unexpected behaviour. If an AI agent can act on a tool, then the tool’s provenance and control status should be governed like any other sensitive integration.

Q: What is the difference between agent evaluation and runtime control?

A: Evaluation tests whether the agent behaved as intended under specified conditions, while runtime control decides what the agent is allowed to do in live operation. Evaluation finds defects. Runtime control limits impact. Mature programmes need both, and they should share the same telemetry so results can be compared.

Technical breakdown

Why trace contracts matter for agent evaluation

Evaluation systems can only score what they can see. If they receive only final output, they miss the tool calls, routing choices, and intermediate model steps that explain why an agent behaved correctly or incorrectly. OpenInference is a semantic tracing layer for LLM workloads, so it records the execution path in a format that evaluation tools can consume. That is what lets ASSERT test behaviour against specification rather than guess from the last response. For governance teams, the point is not simply visibility. It is evidence portability across development, security review, and production monitoring.

Practical implication: require trace-level evidence for agent evaluations, not just end-state outputs.

How runtime controls work across the agent loop

ACS places deterministic controls at five checkpoints in the agent loop: input, model call, state, tool execution, and output. Those checkpoints matter because agent risk often appears between steps, not only at the prompt or final response. A portable policy document means the same rules can be applied across frameworks rather than embedded in one application’s custom code. The key governance shift is that policy lives outside the model and can be reviewed independently. That creates a repeatable boundary for allow, block, or human approval decisions.

Practical implication: map controls to specific loop checkpoints so policy decisions are enforceable and reviewable outside the model.

What a shared telemetry layer changes for observability

When evaluation, policy decisions, and production traces share the same telemetry contract, teams can correlate a blocked action with the earlier evaluation failure that predicted it. That closes the loop between testing and runtime governance. It also reduces the common problem of control drift, where the policy looked correct in test but is impossible to prove in production. For AI security and identity teams, this is especially important where agents touch tools, data, or delegated access. The trace becomes the governance record, not just an engineering debug artefact.

Practical implication: centralise agent telemetry so policy enforcement and incident review use the same evidence base.

NHI Mgmt Group analysis

Shared trace contracts are becoming the practical foundation of agent governance. OpenInference matters less as a developer convenience than as a governance primitive because it creates evidence continuity across evaluation, runtime controls, and observability. That continuity is what allows security teams to inspect agent behaviour without relying on framework-specific instrumentation. In identity terms, this is how delegated actions become auditable instead of opaque. Practitioners should treat trace portability as a control requirement, not a logging preference.

ACS reflects a broader shift from advisory prompts to externally enforced policy. Prompt instructions are easy to bypass, hard to audit, and inconsistent across deployments. A declarative control contract, reviewed once and applied everywhere, is closer to how security teams already think about identity policy, privilege boundaries, and approval workflows. That makes ACS relevant beyond AI engineering because it mirrors the governance model used in IAM and PAM. The lesson is that agent guardrails need an enforceable control plane, not just model behaviour tuning.

Agent traceability gap: when a team cannot connect a model decision to its underlying tool calls, policy actions, and state transitions, it has no durable basis for accountability. This article shows why that gap is the real governance problem, not the absence of another single control. OpenInference closes the evidentiary gap only if teams preserve the full chain from evaluation to runtime to production. For practitioners, the priority is to make trace continuity part of the control standard.

Identity governance for agents must extend to runtime evidence, not just access assignment. Agents that can call tools and act across stateful workflows need controls that prove what was allowed, what was blocked, and why. That shifts the security question from “who has access” to “what evidence exists for each delegated action.” The practical conclusion is that agent identity governance should be measured by trace completeness and control consistency.

This announcement validates a more mature agent security pattern: policy outside the model, evidence inside the trace. That combination is more durable than prompt-only controls because it separates enforcement from generation while preserving auditability. It also aligns with how enterprises already govern privileged action. Practitioners should expect future agent frameworks to compete on how well they support this contract, not just how many tools they can call.

What this signals

Trace completeness will become a governance metric for agent programmes. As agents move from pilots to operational use, teams will need to know whether every tool call, policy decision, and approval is captured in a consistent trace. That is the difference between an AI programme that can be audited and one that can only be observed after the fact. Where agent telemetry is fragmented, control confidence will collapse quickly.

Agent governance is converging with identity governance. Once an agent can execute actions across tools and state, its access path behaves like a privileged identity path, even if it is not a human user. That makes workflow evidence, approval state, and policy enforcement central to IAM and PAM teams. For practitioners, the next step is to align AI governance with the same evidence standards used for privileged access and lifecycle control.

For practitioners

• Define a trace contract for every agent Require every agent framework in scope to emit the same minimum telemetry fields for tool calls, routing decisions, policy outcomes, and state transitions. Without a common trace contract, evaluation and production evidence will never reconcile.
• Map policy checkpoints to agent lifecycle stages Place controls at input, model call, state, tool execution, and output so each decision can be reviewed independently. Treat blocked, approved, and escalated actions as auditable events rather than app-specific behaviour.
• Tie evaluation failure to runtime control changes Use regression testing to identify where an agent violated a spec, then update the runtime control at the same checkpoint and re-test against the same traces. This reduces drift between test and production policy.
• Preserve control evidence for review and incident response Store policy decisions, human approvals, and state transitions alongside agent traces so investigators can reconstruct what happened without relying on application logs alone. This is especially important when agents access tools or sensitive data.

Key takeaways

• AI agent governance fails when evaluation, control, and observability cannot share the same evidence.
• OpenInference matters because it turns agent behaviour into a portable trace contract that can support policy enforcement and review.
• Identity and security teams should treat trace continuity as a control requirement for agentic systems, not as optional telemetry.

Key terms

• OpenInference: A set of OpenTelemetry semantic conventions for AI workloads. It standardises how agent activity, tool calls, model steps, and latency are recorded so different evaluation and observability tools can read the same trace data.
• Trace Contract: A shared telemetry format that defines what evidence an AI system must emit during execution. In governance terms, it lets evaluation, runtime controls, and observability operate on the same record instead of separate logs that cannot be reconciled.
• Agent Control Standard: A shared specification for runtime governance of AI agents. It defines how defenders can intervene before actions execute, so controls can move with the agent across tools, hosts, and trust boundaries instead of remaining locked inside one product.
• Spec-Driven Evaluation: A testing approach that measures an AI agent against declared behavioural rules rather than ad hoc expectations. It is useful for identifying failures in tool use, routing, and policy compliance before those failures reach production.

What's in the full article

Arize's full article covers the operational detail this post intentionally leaves for the source:

• How ASSERT turns behavioural specifications into executable tests for agent regression testing.
• How ACS applies controls at five agent checkpoints, including input, state, tool execution, and output.
• How OpenInference spans flow into Phoenix and Arize AX for production observability.
• How the reference implementation wraps tools with policy enforcement and logs each decision.

👉 Arize’s full post covers the ASSERT and ACS implementation details, trace structure, and runtime enforcement model.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and agentic AI identity. It gives identity and security practitioners a common control language for governing delegated access and runtime evidence.