ACS is the most important Build announcement nobody noticed

Tucked between Frontier Tuning and the Agent Optimization Loop on Day 2, Microsoft published the Agent Control Specification (ACS) — a vendor-neutral spec for runtime agent governance. An agent platform needs three planes: identity (who the agent is acting as), tools (what it can call), and policy (what it is permitted to do, by whom, with what evidence). Entra gives us the first. MCP gave us the second. ACS is the third — and that is why I expect it to outlast every product demo on either stage.

What Microsoft announced

ACS is a published, open specification with reference implementations in Foundry and the Copilot app on day one. It addresses the four questions every agent deployment has had to answer in an ad-hoc way so far: what the agent is allowed to do, who must approve sensitive actions, what data it is allowed to touch, and what evidence each step leaves behind. Until now, every team has answered those questions in its own YAML.

• Declarative manifest of the agent's capabilities and tools
• Per-action approval hooks: silent, prompt, or multi-party
• Data-residency and PII boundaries expressed inside the contract
• Runtime-agnostic audit log format — portable across vendors
• Built on existing identity and policy primitives — no rip-and-replace

Why it lines up with Microsoft's direction

Microsoft's Responsible AI principles — fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability — are only useful when engineers have a place to express them in code that a runtime can enforce. ACS is that place for agents. Capability scopes, approval hooks, data-residency boundaries, and a portable audit log are the engineering primitives those principles need in order to leave policy documents and become behaviour.

ACS also follows a playbook Microsoft has executed before, more than once. The Language Server Protocol did it for editors. OpenAPI did it for HTTP APIs. MCP did it for tools. Each time, the same shape: publish the contract under a permissive license, ship the best reference implementation, then compete on substrate rather than lock-in. Governance is exactly the surface where a single vendor's private file format would be the least acceptable outcome to the buyers who matter most — and Microsoft, this time, did not try to make ACS one.

— Heisenberg, 4 June 2026.