@axiru/agt-extension

Axiru extension for the Microsoft Agent Governance Toolkit (AGT). Routes payment-action tool calls (Stripe, Plaid, ACH, Modern Treasury, Dwolla, Square) to Axiru's policy engine. Non-payment tool calls fall through to AGT's default policies.

Apache-2.0 licensed. Zero runtime dependencies. About 300 lines of code.

What this is

AGT is the seven-package middleware layer Microsoft ships for governing AI agents: policy engine, mesh identity, runtime sandboxing, compliance, marketplace. AGT's default policies cover the broad agent-safety surface (prompt injection, tool-call interception, OWASP Agentic AI Top 10).

This package fills the one box AGT explicitly does not: money-moving actions. Refunds, payouts, ACH transfers, charge captures, and dispute-evidence submissions need human-approval-aware, ledger-backed governance with regulatory audit guarantees. That's what Axiru does, and it's what this extension wires into AGT.

Installation

npm install @axiru/agt-extension
# or
pnpm add @axiru/agt-extension
# or
yarn add @axiru/agt-extension

Requires Node 18+. Works in Edge runtimes when you pass a custom fetch.

Quickstart

import { GovernanceKernel } from "@microsoft/agt-core"; // your AGT version
import { AxiruPolicyProvider, AxiruToolCallInterceptor, isPaymentTool } from "@axiru/agt-extension";

const provider = new AxiruPolicyProvider({
  apiKey: process.env.AXIRU_API_KEY!,
  // baseUrl: "https://api.axiru.com",   // default
  // failureMode: "deny",                 // default; never let payments fire when Axiru is unreachable
  // timeoutMs: 5_000,                    // default
});

const interceptor = new AxiruToolCallInterceptor(provider, isPaymentTool);

const kernel = new GovernanceKernel({
  policyPaths: ["policies/agt.yaml"],
  interceptors: [interceptor],            // payment tools route to Axiru; everything else hits AGT defaults
});

What gets routed to Axiru

By default these tool names route to Axiru's /api/agent/decide endpoint. Everything else passes through to AGT.

| Service | Tools | |---|---| | Stripe | stripe.refund.create, stripe.charge.create, stripe.charge.capture, stripe.payment_intent.create, stripe.payment_intent.confirm, stripe.payout.create, stripe.transfer.create, stripe.dispute.update | | Plaid | plaid.transfer.create, plaid.transfer.cancel | | Modern Treasury | modern_treasury.payment_order.create | | Dwolla | dwolla.transfer.create | | Square | square.refund.create, square.payment.create | | Custom | Any tool with the axiru.refund., axiru.charge., or axiru.payment. prefix |

You can extend or replace the classifier:

import { buildPaymentToolPredicate } from "@axiru/agt-extension";

const predicate = buildPaymentToolPredicate({
  toolNames: [...DEFAULT_PAYMENT_TOOL_NAMES, "acme.invoice.refund"],
  toolPrefixes: ["acme.payout."],
  custom: (name) => name.endsWith(".transfer"),
});

const interceptor = new AxiruToolCallInterceptor(provider, predicate);

Failure modes

When Axiru's API is unreachable or returns 5xx:

• failureMode: "deny" (default). Payment is denied with a clear reason. Use this for production.
• failureMode: "allow". Payment passes through to AGT's default policies. Use this in shadow-mode evaluations where Axiru is observing but not enforcing.

4xx responses (auth failure, validation error) are always treated as authoritative denies regardless of failureMode. A misconfigured deployment never gets silently elevated to allow money movement.

What this is not

• Not a replacement for AGT. AGT's default policy engine, mesh identity, prompt-injection detection, and marketplace are unchanged. This extension only intervenes for payment-class tool calls.
• Not a general Axiru client. If you are calling Axiru directly rather than through AGT, use the HTTP API. This package is specifically the AGT bridge.
• Not a way to skip the Axiru API key. You need an Axiru account. Sign up at axiru.com/start-free.

Audit trail

Every payment-class tool call routed through this extension creates a tamper-evident entry in the Axiru ledger with the AGT agentId, the tool name, the policy version that decided, and the decision id. AGT's metadata field on each decision carries decisionId and policyVersion so you can join AGT logs to Axiru ledger entries 1:1 without custom integration.

Versioning

This package follows semver. Breaking changes to the AGT-side interfaces (e.g. if Microsoft renames PolicyProviderInterface) will bump the major. The Axiru API surface (/api/agent/decide) is versioned separately and remains backwards compatible across minor bumps of this package.

Related packages

• @axiru/agent-spend-guardrails runs the same class of policy checks fully in process, with no API key and no network call.
• @axiru/spec is the shared policy and evidence vocabulary both packages speak.

License

Apache-2.0. Copyright 2026 Axiru. See LICENSE.