# Agent Control Standard

An open wire specification letting a separate Guardian Agent inspect what an AI coding agent is about to do and permit, deny or modify that action before it happens over an authenticated channel, with an audit trail that can be reconstructed afterward.

Agent Control Standard (ACS) defines the protocol between an AI agent and a Guardian process that decides whether a proposed action is allowed, rather than shipping a specific policy engine itself. Its reference implementation runs Microsoft's Agent Governance Toolkit behind the ACS wire contract with host shims for Claude Code and OpenCode, and a bundled example rule blocks a destructive shell command such as an rm -rf / issued by a connected coding agent, returning a deny decision with a named reason code and policy reference that an Inspector process displays as the decision crosses the wire.

The project is explicit that a documented failure posture matters: by default, if the policy engine cannot be reached the Guardian proceeds rather than blocking, and this can be overridden to deny by default instead. A hook payload can also be piped directly into the host shim to get the same allow-or-deny decision without a coding agent installed at all, and every decision is logged to an envelope log and a session-context log for later review.

It is written in TypeScript, requires Bun to run the reference implementation, and is released under the Apache-2.0 license.

Website: https://genai-security-project.github.io/agent-control-standard/