Microsoft Open-Sources Rampart and Clarity to Embed AI Agent Safety Into Dev Pipelines

Redmond, Wash. — Microsoft released two open-source tools this week designed to move AI safety checks out of periodic reviews and into continuous development pipelines, as the company's AI red team publicly argued that agentic systems require a new class of engineering discipline.

The tools are named Rampart and Clarity. Both are now available as open-source projects from Microsoft and target risks specific to AI agents, including prompt injection, unsafe tool use, privilege escalation, and unintended autonomous actions — risks that traditional application security workflows were not built to catch.

"We built these tools because we believe that AI safety has to become a continuous engineering discipline rather than a periodic checkpoint," said Ram Shankar Siva Kumar, founder of Microsoft's AI red team, in a security blog post published alongside the release.

Microsoft did not specify what incident or internal finding prompted the timing.

Rampart: Red-team findings as repeatable tests

Rampart is built on top of PyRIT, Microsoft's existing open automation framework for red-teaming generative AI systems. The distinction matters. PyRIT is optimized for black-box discovery by security researchers after a system is built; Rampart is aimed at engineers while the system is still being constructed.

The framework plugs into CI/CD workflows and runs both adversarial and benign test scenarios against AI agents in an automated, structured way. It targets cross-prompt injection, unsafe data handling, and insecure tool execution (among the attack paths Microsoft said traditional pipelines miss). And it converts red-team findings into repeatable automated tests, letting engineering teams check for regressions as agents change over time.

Clarity: Examining design assumptions before code is written

Clarity sits earlier in the process. It runs as a desktop app, a web UI, or embedded directly in a coding agent, and it guides engineers through structured conversations about what an AI agent is supposed to do, what permissions it needs, and where trust boundaries lie.

"It guides engineers through structured conversations covering problem clarification, solution exploration, failure analysis, and decision tracking," Siva Kumar said.

Outputs are written to a .clarity-protocol/ directory as markdown files (committed, reviewed in pull requests, and diffed like source code), which means design-level safety decisions become part of the version-controlled record. That detail is significant: it creates an audit trail that could matter in future regulatory contexts.

So the two tools bracket the development lifecycle, with Clarity upstream and Rampart downstream, rather than operating as a single unified framework.

But neither tool addresses runtime monitoring of deployed agents. Microsoft's blog post did not address that gap.

Part of a broader internal governance push

Microsoft framed Rampart and Clarity as components of a larger effort. Last month the company released the Agent Governance Toolkit, which covers policy enforcement and OWASP-aligned protections for AI agents. The new tools extend that stack further into the engineering workflow.

The NVD entry for CVE-2025-21333, a January 2025 Windows privilege escalation flaw, remains one of the more recent examples of what happens when agent-adjacent processes run with excessive permissions — a problem Rampart is explicitly designed to surface earlier.

Both tools are available now from Microsoft's GitHub repositories. No advisory ID has been assigned; no regulatory filing is attached to the release.