Microsoft Governance Toolkit Linter Misses Policy Rules That Can Never Match

In August, a report was filed against Microsoft's Agent Governance Toolkit describing a policy linter that accepts rules which can never match, while the evaluator silently applies its default action. Reproductions on the published PyPI packages showed three cases, including a misspelled field, an empty value set, and a rule shadowed by a higher-priority allow, all of which passed the linter with no issues. The defect is hard to detect in practice because the policy file appears valid and audit logs look normal, and under a default-allow setting it fails open. A maintainer's October audit confirmed the problem and found additional failure modes, while noting that a fix merged into the migrator does not reach the legacy evaluator and linter still distributed to pip users. The issue remains open for those reasons.