The most useful thing about Microsoft’s Agent Governance Toolkit is that it refuses to pretend prompts are a permission system. That should not be a controversial position in 2026, but here we are: teams are connecting agents to codebases, databases, ticketing systems, browsers, email drafts, cloud APIs, and MCP