Your organisation is deploying autonomous agents. They’re writing code, making API calls, and executing shell commands. What governance tooling actually exists?
PT-Edge tracks 1,263 repositories across 12 agent governance subcategories. We score them daily. Here’s what the data says about the state of agent governance in 2026.
The governance stack has four layers
Agent governance isn’t one problem. It’s a stack: sandboxing (runtime isolation), guardrails (pre-action authorisation), monitoring (observability), and auditing (compliance). Each layer is at a different maturity level.
Sandboxing is the only mature layer
E2B (85/100, 11K+ stars) is the market leader for cloud agent sandboxes. Alibaba’s OpenSandbox (83/100, 7.7K stars, 352 commits last month) is the enterprise-grade alternative with Docker/K8s runtimes.
For local development, agent-safehouse (1.2K stars, 492 HN points) offers macOS-native isolation, while nono (980 stars) provides kernel-enforced, capability-based sandboxing in Rust with cryptographic audit chains.
Sandboxing has real adoption because isolation is the most tractable problem. You can sandbox an agent in an afternoon. The other layers require more organisational work.
Guardrails: early but accelerating
Microsoft’s agent-governance-toolkit (61/100) is the most comprehensive: policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering. It’s the only project claiming full OWASP Agentic Top 10 coverage.
guardrails-ai (6.5K stars) is the most adopted, but it guards LLM outputs, not agent actions. For teams that need to intercept and authorise what agents do before they do it, DashClaw and agent-control are the emerging options.
There are 250 repos in the guardrails category, but average quality is just 24/100. Most are experimental. The gap between what enterprises need and what exists is wide.
The compliance gap is real
The most striking finding: almost no tooling connects agent actions to regulatory frameworks. Only agent-shield attempts EU AI Act, GDPR, OWASP, and NIST AI RMF compliance scoring. NIST is actively seeking public comment on AI agent security standards. The standards are being written, but the tools to implement them barely exist.
For enterprises deploying agents in regulated environments, this is the biggest gap and the biggest opportunity.
Three patterns to watch
Sandboxing first, governance later. Most teams start with isolation, then add guardrails as they understand their agents’ behaviour.
The OWASP Agentic Top 10 is creating a shared vocabulary. Microsoft’s toolkit and agent-audit both map to it. Expect more alignment over the next year.
Monitoring and governance are converging. Tools like AgentOps, TruLens, and coze-loop are adding policy features. Governance tools are adding observability.
Explore the full data
The full deep dive with detailed data tables and quality comparisons is at mcp.phasetransitions.ai/insights/agent-governance-landscape.
Every project is quality-scored daily in our agents directory. Browse 250 guardrails projects, 114 sandboxing tools, or check what’s trending this week.
The 4-layer framework is accurate and the compliance gap is the one that will bite hardest, EU AI Act Phase 2 arrives August 2026 and organizations that only have sandboxing will have no audit trail to demonstrate compliance.
The monitoring layer is what connects the sandbox to the compliance report: every agent action needs a tamper-evident log tied to the policy that governed it.
The gap between sandboxing (mature) and policy enforcement (barely exists) - this is the layer that actually bit me. I had 50+ automation scripts running against a custom system I built, and the policy was effectively: whatever the agent tried, the script either worked or threw an exception. No audit trail, no rollback surface, no way to answer what it did last Tuesday at 3am.
Migrated to self-hosted open-source kanban recently and the state machine became visible for the first time - board columns as lifecycle stages gave me the governance surface I didn't know I was missing. Not solving the compliance layer you're describing, but observable state turns out to be prerequisite to all of it.