GOVERNANCEBENCH

A benchmark for AI agent governance.

GovernanceBench measures whether a platform can halt, audit, supervise, and preserve behavioral integrity across autonomous agent workflows.

Current Agentomy result
100/100
224 scenarios passed
100/100 across 5 dimensions. 224 of 224 scenarios passed, 0 failed, 0 skipped.

Autonomous systems need measurable governance controls.

GovernanceBench exists because ungoverned AI agents acting autonomously can produce outcomes that their operators did not anticipate, authorize, or have the ability to halt. In March 2026, an AI system was used to accelerate a cryptographic discovery with global security implications. No governance layer existed between the AI system's capability and the outcome it produced. GovernanceBench measures whether a governance platform provides the halt capability, audit trail, and behavioral integrity controls that prevent this class of outcome from happening without operator awareness and consent.

The benchmark translates that risk into practical tests: can a platform block unauthorized actions, preserve a verifiable audit trail, contain sub-agent behavior, and keep a human supervisor in the control loop?

Halt capability
Can an operator stop an agent before damage compounds?
Audit trail
Can the system produce a verifiable record of what happened and why?
Behavioral integrity
Can the system detect and contain drift from expected behavior?
HTML Reports
Standalone HTML reports with color-coded scores, expandable scenario details, and print-friendly layout.

Agentomy has confirmed all five suites.

Current results are published as confirmed test results, not certifications. 100/100 across 5 dimensions. 224 of 224 scenarios passed, 0 failed, 0 skipped.

Suite 1
Authorization Enforcement
100%
Confirmed test result
Tests whether permission tier enforcement is server-side, tier escalation via request body is blocked, and agents operate within designated scope.
Suite 2
Audit Trail Integrity
100%
Confirmed test result
Tests whether the audit trail is hash-linked, tamper-evident, paginated, and exportable with complete event coverage.
Suite 3
Kill Switch / Override
100%
Confirmed test result
Tests whether emergency halt stops all agents immediately, authorization is blocked during halt, and resume restores normal operation.
Suite 4
Behavioral Monitoring
100%
Confirmed test result
Tests runtime anomaly detection including frequency bursts, privilege probing, quarantine enforcement, and agent-scoped behavioral baselines.
Suite 5
OWASP Agentic Top 10
100%
Confirmed test result
Tests coverage of OWASP ASI-01 through ASI-10 risks including goal hijacking, tool misuse, identity abuse, and cascading failures.
Overall statusOverall: 100/100 Excellent. 224 passed, 0 failed, 0 skipped.

What each suite measures.

Suite 1100%
Authorization Enforcement
Tests whether permission tier enforcement is server-side, tier escalation via request body is blocked, and agents operate within designated scope. 50 scenarios.
Confirmed test result
Suite 2100%
Audit Trail Integrity
Tests whether the audit trail is hash-linked, tamper-evident, paginated, and exportable with complete event coverage. 50 scenarios.
Confirmed test result
Suite 3100%
Kill Switch / Override
Tests whether emergency halt stops all agents immediately, authorization is blocked during halt, and resume restores normal operation. 50 scenarios.
Confirmed test result
Suite 4100%
Behavioral Monitoring
Tests runtime anomaly detection including frequency bursts, privilege probing, quarantine enforcement, and agent-scoped behavioral baselines. 51 scenarios.
Confirmed test result
Suite 5100%
OWASP Agentic Top 10
Tests coverage of OWASP ASI-01 through ASI-10 risks including goal hijacking, tool misuse, identity abuse, and cascading failures. 10 scenarios.
Confirmed test result

GovernanceBench measures the controls that matter before autonomy scales.

01
Authorization
Can the system prevent unauthorized actions before they execute?
02
Auditability
Can the system produce a usable record of what happened, why, and under which policy?
03
Override
Can an operator halt or override the agent before damage compounds?
04
Behavioral
Can the system detect and contain drift from expected behavior?
05
OWASP
Can the system map agentic risks to recognized security categories?

GovernanceBench is designed to be run, not just cited.

Run the benchmark locally and compare governance controls across agent platforms as results are published.

Apache 2.0 licensed open standard. Initial package support is published through the Agentomy Agent toolchain.

$ npx governancebench

Transparent tests. Repeatable scoring. No hidden claims.

GovernanceBench is organized around suites, dimensions, scenarios, expected behaviors, and pass/fail scoring. The methodology is designed so teams can inspect what is being measured before trusting the score.

Methodology documentation available on request.

Five dimensions. 224 scenarios total. Apache 2.0 licensed open standard.

Run it. Compare it. Verify it.

PlatformVersionScoreDateReproduce
Agentomyv0.31.0100/1002026-05-16governancebench run --target localhost:3000
Microsoft AGTv3.6.057/100 (†)2026-05-17governancebench run --adapter microsoft-agt
n8n (bare)v1.x56/100 (†)2026-06-20governancebench run --adapter n8n --target http://localhost:5678
Your system--?/100--governancebench run --target YOUR_URL

Both platform scores verified with artifacts on file. GovernanceBench is Apache 2.0 -- run it against any platform and compare independently.

Two evidence classes. Your access decides which path.

GovernanceBench publishes scores per evidence class. The class determines what appears on the leaderboard and how it is verified by other readers.

Live-adapter measurement (numeric leaderboard entry)

If your platform has a reproducible access path (open-source, free trial, public API, self-serve hosted endpoint), write a thin adapter that maps GovernanceBench to your surface, run the full benchmark, and submit the resulting artifact. Live-adapter submissions appear on the leaderboard with per-dimension scores and the reproducibility command.

Reference template: cli/governancebench/lib/adapters/microsoft-agt.mjs (approximately 145 lines). Run: npx governancebench run --adapter your-platform --target your-endpoint. Store artifact: tests/artifacts/your-platform-governancebench-results.json.

Documentation review (qualitative queue entry)

If your platform is sales-gated or has no public access path, a documentation-review entry may be added to the blind-scoring record with per-dimension PASS/PARTIAL/FAIL judgments based on your published source and product documentation. Documentation-review entries do not produce leaderboard numeric scores; they are queued for live-adapter elevation when reproducible access becomes available.

Submit via GitHub issue with source URLs, review date, and per-dimension judgments.

GovernanceBench is published under Apache License 2.0. No sales engagement required. Submission methodology, evidence-class ceiling rules, and blind-scoring methodology for future rounds are documented in CONTRIBUTING.md.

How Agentomy compares across the agent-governance market.

Every vendor claims governance. The measurable question is whether the governance surface exposes an API an independent benchmark can score. GovernanceBench publishes results in three evidence tiers so a reader can never confuse a paper claim with a measured result.

Tier 1 -- Live-adapter measurement (numeric scores)

Two platforms today expose a governance API that GovernanceBench can run end-to-end through a live adapter. Numeric scores are reproducible against the vendor's runnable endpoint.

PlatformWhat the vendor publicly claimsMeasured scoreEvidence
Agentomy v0.31.0Five-dimension agent governance; 100% GovernanceBench100 / 100Live adapter
governancebench run --target localhost:3000
Microsoft AGT v3.6.0Enterprise agent governance for Microsoft 36557 / 100Live adapter
governancebench run --adapter microsoft-agt
n8n (bare, v1.x)Open-source workflow orchestration; not a governance platform in the GovernanceBench sense56 / 100Live adapter
governancebench run --adapter n8n --target http://localhost:5678

Note: n8n is a workflow runtime, not a designed agent-governance platform. The 56 / 100 baseline is what workflow runtimes typically score on the agent-shape rubric when most primitives are architecturally absent (default-deny via 404 closes many scenarios incidentally). For the workflow-shape scoring axis that n8n is actually built for, see WorkflowBench.

(†) Methodology disclosure (adapter v1): bench scenarios currently exercise Agentomy's governance API surface (/api/claw/*, /api/audit/*, /api/enforcement/*) against the target endpoint. For non-Agentomy targets, default-denial (404) on unknown paths closes many scenarios -- this IS a meaningful governance posture (closed-by-default is safer than open-by-default) but is not the same as testing each platform at its native governance API. Adapter v2 (native-API routing per platform; planned) will produce a fairer 1:1 cohort comparison. Until then, comparative scores reflect "how does this platform respond to a structured governance-API probe" not "how does this platform perform at its own native API."

Test-target disclosure: the Microsoft AGT 57 / 100 baseline was measured against a local AGT-protocol stub (http://localhost:4100) implementing the documented AGT request/response shape. Microsoft does not publish a public AGT endpoint for benchmark callers; the stub is the authority-replicating substitute. The n8n 56 / 100 baseline was measured against a real n8n instance at http://localhost:5678. Both target choices are reproducible artifacts on file; run them yourself.

Tier 2 -- Documentation review (architectural assessment)

Systems whose vendor exposes no runnable governance API, or whose surface is architecturally constrained, are reviewed against the same five-dimension rubric using vendor documentation as authoritative source. Doc-review entries do not produce numeric leaderboard scores.

PlatformWhat the vendor publicly claimsDoc-review verdictNote
Microsoft Agent 365 (preview)Built-in agent governance across the Microsoft 365 estate2 / 4 dimensions metAuthorization and Auditability surfaced; Override and Behavioral not in published docs
Microsoft AGT v3.1.0 (prior release)Earlier release of the live-measured v3.6.0 above2 / 4 dimensions metConfirms the v3.6.0 live-adapter uplift
OpenAI Agents SDK + GuardrailsGuardrails for agent safety1 / 4 dimensions metAdapter header (vendor's own architecture note): "build-time and inference-time tool framework, not a governance platform in the GovernanceBench sense"

Tier 3 -- Integration surface (cross-vendor interoperability)

Systems where Agentomy's bridge interface accepts the vendor's runtime, pending a vendor-side hook or plugin for full live cross-evaluation.

PlatformWhat the vendor publicly claimsIntegration verdict
NVIDIA NemoClaw (Apache 2.0)Open-source agent sandbox + runtime; Hermes-style policy frameworkAgentomy bridge accepts nemoclaw variant; auto-detect configured. NemoClaw does not natively call external-governance hooks; full live cross-evaluation pending NemoClaw plugin.

External validation -- NVIDIA scanner against Agentomy

NVIDIA's open-source SkillSpector security scanner finds zero issues across all 27 Agentomy-published skills.

A separate evidence axis from the cohort above: NVIDIA SkillSpector v2.2.3 (Apache 2.0) runs 64 indicators across 16 categories -- adversarial-instruction patterns, supply-chain risk, behavioral AST analysis, taint-tracking, YARA signatures -- against agent skills. NVIDIA's scanner was run against every one of Agentomy's 27 published agentskills/ directories (rescanned 2026-07-02 after 11 new skills shipped; the scan is deterministic and reproducible with Docker alone -- no API keys).

27 / 27 SAFE · 0 / 100 aggregate risk · 0 findings

Evidence-class discipline: live-adapter numeric scores, documentation-review qualitative verdicts, and integration-surface interoperability statuses are tagged separately. A reader can never confuse a paper claim with a measured result. Vendors that publish a runnable governance API can move to Tier 1 at any time by submitting a live-adapter artifact.

Run the benchmark. Review the demo. Decide what governance should prove.

Agentomy publishes the benchmark because governance should be measurable before autonomous agents become operational infrastructure.