MyAGTSamples

Sample .NET console applications for Microsoft Agent Governance scenarios.

This repository includes eight focused examples that cover policy evaluation, agent identity and trust, Microsoft Agent Framework (MAF) integration, Agent Framework Harness file access, and audit/telemetry export.

What's in this repository

Project	Focus	Target Framework
AGTPolicyApp01	Basic policy-driven tool call evaluation with a local YAML policy	net10.0
AGTOpaPolicyApp01	OPA/Rego policy evaluation for tool call governance	net10.0
AGTCedarPolicyApp01	Cedar policy evaluation for tool call governance	net10.0
AGTPolicyWithMAFApp02	MAF + Azure OpenAI with governance middleware and tool blocking	net10.0
AGTIdentityApp01	Agent identity (DID/public key) and trust score basics	net10.0
AGTIdentityWithMAFApp02	Trust-score-aware tool execution in a MAF agent flow	net10.0
AGTAuditBlobTelemetryApp01	Governance audit to Azure Blob + telemetry to Application Insights	net10.0
AGTPolicywithMAFApp03	Agent Framework Harness file access with governed read-only operations	net10.0

Solution structure

• MyAGTSamples.sln contains all eight projects above.
• Policy files are under each project's policies/ folder where applicable.
• AGTAuditBlobTelemetryApp01 also includes BlobAuditSink.cs and a project-level README with deep details.

Prerequisites

1. .NET SDKs:
   • .NET 10 SDK
2. Azure CLI (az) signed in when running MAF/OpenAI samples that use AzureCliCredential.
3. Access to Azure OpenAI (for MAF/OpenAI-based projects).

Check installed SDKs:

dotnet --list-sdks

Build all projects

From repository root:

dotnet restore
dotnet build MyAGTSamples.sln

Run each sample

From repository root:

1) AGTPolicyApp01

dotnet run --project AGTPolicyApp01/AGTPolicyApp01.csproj

Behavior:

• Loads AGTPolicyApp01/policies/default.yaml
• Evaluates sample tool calls (for example file_write, http_request)
• Prints allow/deny results

2) AGTOpaPolicyApp01

dotnet run --project AGTOpaPolicyApp01/AGTOpaPolicyApp01.csproj

Behavior:

• Loads OPA/Rego policy from AGTOpaPolicyApp01/policies/toolcall.rego
• Evaluates sample tool calls (http_request, execute_shell, file_read)
• Demonstrates blocking execute_shell tool via Rego policy
• Prints allow/deny results

3) AGTCedarPolicyApp01

dotnet run --project AGTCedarPolicyApp01/AGTCedarPolicyApp01.csproj

Behavior:

• Loads Cedar policy (inline in code)
• Evaluates sample tool calls (http_request, execute_shell, file_read)
• Demonstrates basic Cedar policy syntax with PolicyEngine.LoadCedar()
• Prints allow/deny results
• Note: For tool-specific filtering, YAML or OPA policies offer richer support

4) AGTPolicyWithMAFApp02

Required environment variables:

• AZURE_OPENAI_ENDPOINT
• AZURE_OPENAI_DEPLOYMENT_NAME (optional, default in code: gpt-5-mini)

Run:

dotnet run --project AGTPolicyWithMAFApp02/AGTPolicyWithMAFApp02.csproj

Behavior:

• Uses governance middleware with MAF tools
• Applies policy from AGTPolicyWithMAFApp02/policies/default.yaml
• Demonstrates a blocked GetWeather call and a normal non-tool response

5) AGTIdentityApp01

dotnet run --project AGTIdentityApp01/AGTIdentityApp01.csproj

Behavior:

• Creates an agent identity
• Prints DID/public key/status
• Loads trust score from a local file trust store

6) AGTPolicywithMAFApp03

Required environment variables:

• AZURE_OPENAI_ENDPOINT
• AZURE_OPENAI_DEPLOYMENT_NAME (optional, default in code: gpt-5-mini)

Run:

dotnet run --project AGTPolicywithMAFApp03/AGTPolicywithMAFApp03.csproj

Behavior:

• Uses Agent Framework Harness FileAccessProvider tools for the sample files
• Allows listing, reading, and searching files
• Blocks writing, replacing, and deleting files through an Agent Governance Toolkit policy
• Uses separate Harness Name and governance DefaultAgentId values; see the project README for details

7) AGTIdentityWithMAFApp02

Required environment variables:

• AZURE_OPENAI_ENDPOINT
• AZURE_OPENAI_DEPLOYMENT_NAME (optional, default in code: gpt-5-mini)

Run:

dotnet run --project AGTIdentityWithMAFApp02/AGTIdentityWithMAFApp02.csproj

Behavior:

• Uses trust-based policy from AGTIdentityWithMAFApp02/policies/trust-based.yaml
• Starts at trust score 500, then applies a penalty
• Shows first tool call allowed and second tool call blocked

8) AGTAuditBlobTelemetryApp01

Required environment variables:

• AZURE_OPENAI_ENDPOINT
• AZURE_OPENAI_DEPLOYMENT (optional, default in code: gpt-5-mini)
• APPLICATIONINSIGHTS_CONNECTION_STRING
• AZURE_STORAGE_ACCOUNT_NAME

Optional:

• AZURE_TENANT_ID
• AUDIT_STORAGE_CONTAINER (default: agt-audit)

Run:

dotnet run --project AGTAuditBlobTelemetryApp01/AGTAuditBlobTelemetryApp01.csproj

Behavior:

• Writes governance events to an Azure Blob append blob (JSONL)
• Exports logs/metrics/traces via Azure Monitor OpenTelemetry exporter
• Demonstrates allow/deny policy decisions and direct governance evaluation

Policy files

File	Default action	Notable rule
AGTPolicyApp01/policies/default.yaml	deny	Rate limits http_request at 100/minute
AGTOpaPolicyApp01/policies/toolcall.rego	deny	Allows all tools except execute_shell
AGTCedarPolicyApp01/policies/toolcall.cedar	N/A (inline in code)	Basic permit policy for demonstration
AGTPolicyWithMAFApp02/policies/default.yaml	allow	Denies GetWeather
AGTPolicywithMAFApp03/policies/default.yaml	allow	Allows read-only file access and denies writes/deletes
AGTIdentityWithMAFApp02/policies/trust-based.yaml	allow	Denies calls when trust_score < 500
AGTAuditBlobTelemetryApp01/policies/default.yaml	deny	Allows specific tools and denies execute_shell

Common troubleshooting

• Build fails due to SDK mismatch:
  • Install the .NET 10 SDK, then re-run dotnet build.
• Azure auth errors:
  • Run az login and verify the active subscription/tenant.
• Environment variable errors:
  • Confirm required variables are set for the project you run.
• Policy file not found:
  • Build first so policy files are copied to output directories.

Notes

• This repository intentionally mixes simple local-only samples and Azure-connected samples.
• For deeper audit/telemetry details, see AGTAuditBlobTelemetryApp01/README.md.