The SDK Proliferation
The AI agent market now has five major SDKs from five vendors:
| SDK | Provider | Focus |
|---|---|---|
| Claude Agent SDK | Anthropic | Tool use + MCP, battle-tested from Claude Code |
| OpenAI Agents SDK | OpenAI | Multi-agent orchestration, evolved from Swarm |
| Microsoft Agent Framework | Microsoft | AutoGen + Semantic Kernel unified, GA imminent |
| CrewAI | CrewAI | Multi-agent orchestration, 44.6K GitHub stars |
| LangGraph | LangChain | Complex orchestration, 38M downloads |
Each SDK is excellent at building agents. None of them governs agents built with other SDKs. This is the governance gap that enterprises need to solve.
The Enterprise Reality
In practice, enterprises don’t standardize on one SDK. Different teams choose different tools:
- Engineering picks Claude Agent SDK for its MCP integration and tool-use reliability
- IT uses Microsoft’s Agent Framework because it integrates with their existing Copilot infrastructure
- Data science chooses LangGraph for complex orchestration workflows
- Operations deploys CrewAI for multi-agent task automation
- Product experiments with OpenAI Agents SDK for rapid prototyping
This isn’t dysfunction — it’s rational choice. Each team picks the SDK that best fits their use case. The problem arises when governance needs to span all of them.
SDKs Build Agents. They Don’t Govern Across SDKs.
Each SDK provides its own management capabilities:
- Anthropic’s Claude Agent SDK has enterprise “Agent Skills” — centrally provisioned, admin-controlled
- OpenAI’s Agents SDK has guardrails and handoff primitives
- Microsoft’s framework has Copilot Studio with HITL previews
But these governance features only apply to agents built with that specific SDK. When your engineering team’s Claude agents need to coordinate with your IT team’s Microsoft agents — neither SDK governs the interaction.
This is the architectural equivalent of each programming language having its own security model, with no operating system to unify them.
The Governance Layer
JieGou sits above every SDK as the unified governance layer:
+-------------------------------------------+
| JieGou Governance Layer |
| (10 layers, GovernanceScore, compliance) |
+-------+-------+-------+------+-----------+
| Claude| OpenAI| MSFT | Crew | Lang |
| Agent | Agents| Agent | AI | Graph |
| SDK | SDK | Frame | | |
+-------+-------+-------+------+-----------+Agents built with any SDK connect to JieGou via triple protocol support:
- MCP (Model Context Protocol): the standard for tool-use agents
- A2A (Agent-to-Agent): Google’s agent communication protocol
- AGENTS.md: declarative agent capability manifests
Once connected, JieGou applies 10-layer governance regardless of how the agent was built:
- RBAC with 6 roles and 24 permissions
- Audit logging with 30+ event types
- Tool approval gates per tool and per role
- Escalation protocols with human-in-the-loop triggers
- GovernanceScore (8-factor, 0-100)
- Compliance mapping to EU AI Act, NIST RMF, and ISO 42001
The BYOK/BYOM Advantage
JieGou’s BYOK (Bring Your Own Key) and BYOM (Bring Your Own Model) architecture means there’s no vendor lock-in at the model layer either. An agent built with OpenAI’s SDK can use Anthropic’s Claude model. A LangGraph agent can use Google’s Gemini. The SDK, the model, and the governance layer are all independent.
This is the difference between a vertically integrated stack (one vendor controls everything) and a horizontally layered architecture (best-of-breed at each layer). JieGou provides the governance layer; you choose the SDK and model.
The Analogy
Think of SDKs as programming languages. Each has its own strengths, community, and ecosystem. No enterprise uses only one programming language. And no enterprise expects each programming language to provide its own security model.
Instead, the operating system provides a unified security layer — authentication, authorization, access control, audit logging — that works regardless of which language the application was written in.
JieGou is the operating system’s security layer for AI agents. The SDK is how you build the agent. JieGou is how you govern it.
Getting Started
Connecting any SDK-built agent to JieGou takes three steps:
- Register: Agent connects via MCP, A2A, or AGENTS.md
- Configure: JieGou applies governance based on department, role, and risk profile
- Monitor: One dashboard, one GovernanceScore, one compliance report
Build with any SDK. Govern with JieGou.
See the interactive SDK Governance Architecture. Compare JieGou’s governance depth at Governance Stack.