Somesh Zanwar.

Open source

Agent governance, in public

Merged code, issue reports and discussion are different things, so they are separated here and labelled as what they are.

Merged codePublic pull requests

Microsoft Agent Governance Toolkit

Five merged pull requests, moving from fixing what I found broken to contributing a pattern.

#1818 · Data quality-aware governance adopter entry

Listed my Data Quality-Aware Agent Governance project in the adopters directory.

#2038 · Agent SRE tutorial fixes

Fixed Windows Unicode rendering and an outdated ChaosLibrary API call in the tutorial.

#2114 · AgentMesh quickstart scaffolding fixes

Repaired quickstart commands, generated scaffold dependencies and client initialization.

#2224 · Data quality-aware governance example

An example combining agent authorization with data quality checks to allow or block an action.

#2278 · dbt-backed data quality evidence adapter

Extended the example with a dbt results adapter, typed quality evidence and synthetic scenarios.

These are examples, docs and an adapter. I did not change AGT's core policy engine.

Issue reportsWritten contributions, not merged code

AgentTrust

Issue reports and spec reviews against the AgentTrust repositories. These are written contributions, not merged code, and closing an issue does not mean my proposed change shipped.

cmcp #324

Reproduced a mismatch where the runtime allowed software-only development-mode claims and the JSON schema rejected them.

trace-spec #29

Proposed an OWASP Agentic AI Top 10 crosswalk separating what TRACE can verify from what it cannot establish.

agent-manifest #153

Found missing verifier enforcement for RAG corpus poisoning-scan states, including flagged and not-scanned.

agent-manifest #151

Flagged human-in-the-loop approval examples that used SPIFFE workload identifiers for human approvers.

ProposalsStandards work

A2A (Agent2Agent protocol)

A proposal and a discussion contribution. Neither is a merged change.

Issue #1835 · open

Proposed a vendor-neutral, documentation-only enterprise governance and production-readiness checklist: identity, authorization, delegation, auditability, tenant isolation, monitoring and incident response.

CTEF discussion #1786

Contributed thinking on binding data-quality evidence to agent handoffs through a snapshot hash and the CTEF source_version mechanism.