Microsoft has published a specification that lets teams write portable policy files governing what AI agents can and cannot do.
The spec targets an unusual coalition of developer, compliance, and security teams, three groups that rarely share the same toolchain. Teams can define policies in separate files that agents are expected to follow, rather than baking restrictions directly into application code. The "portable" framing matters: it implies policies travel with the agent across different environments or runtimes, rather than coupling tightly to a single deployment.
Enterprises have been cautious about deploying autonomous agents partly because there is no clean answer to who controls what an agent does. A portable policy layer gives compliance teams a legible surface to write rules without touching model logic. If the spec gains traction beyond Microsoft's own stack, it positions the company as a de facto standards-setter for enterprise agent governance, a lucrative place to own.
That outcome depends on ecosystem buy-in Microsoft does not yet have. For now, the company is both writing the spec and building the platforms agents run on, a combination that tends to favor adoption on its terms.