Agent Foundry: A Boundary-Preserving Architecture for Governed Agentic Platforms

Abstract

Agent frameworks expose tools, delegation, memory and human approval, yet the controls attached to a request (identity, tenant, scopes, budgets, deadlines, rate limits, fail behavior) are routinely lost at execution boundaries: delegation, threads, streaming, resume, caching, retrieval and adapter exports. We present Agent Foundry, an open-source Python platform whose architecture is organized around one principle: every control is a property of the request’s execution scope, not an argument that each layer must remember to pass. We formalize this as the Governed Execution Contract (GEC), a meet-semilattice of control scopes with seven invariants, and prove that delegation can only attenuate authority, that deny rules can only tighten resolution, that per-principal rate limits are exact under arbi-trary thread interleavings, that every call yields exactly one audited decision even when the policy source is unreachable, and that admission partitions by principal without cross-shard coordination. On AgentGovBench, a public 48-scenario gov-ernance benchmark, Agent Foundry passes 48/48 in 10 of 10 repetitions, against 46/48 for the best published governed configuration and 13/48 for each of 7 pub-lished framework-native runners; run through the same harness, Microsoft’s Agent Governance Toolkit scores at most 46/48 and Bounded Agents 36/48, and on a 24-scenario suite authored blind to our code Agent Foundry scores 24/24 against 17 and 8. A set of 13 single-control ablations attributes 35 of the 48 scenarios to specific mechanisms and exposes a measurement problem: a runner that denies every call scores 31/48, above the audit-only reference, and two controls can be re-moved without losing an official point. Eight supplemental discriminating scenar-ios and three anti-vacuity checks close that gap. A 360-degree evaluation covers the remaining layers: multi-agent coordination overhead is 5.6–154× lower than LangGraph’s on identical topologies; the control plane adds 14 μs per call over the tool gateway and scales to 25,172 governed calls/s across 8 principal-affine shards with exact limits; budgeted context assembly retains a planted fact in 100% of cases up to 1,426,941 history tokens where a recency window retains 20%; a trained input gate raises held-out prompt-injection recall from 0.0% to 80.0%. On WorkBench, matched Foundry runtimes are statistically indistinguishable from the benchmark’s reference loop with one model; we do not claim task-level state of the art. All results regenerate from committed raw evidence.