MCP — Governed agent access

Control which AI agents may act on your data, what they may do, and review everything they did.

MCP enablement

Enabling registers this tenant with the governed runtime (activates pinned packs, writes tool permissions). No subscription key — agents authenticate with OAuth client credentials below. Enable/disable is idempotent and audited.

Emergency kill switch

Immediately blocks every tool call for this tenant without disabling configuration. Takes effect in < 60 s, reversible, fully audited.

Agent credentials

Each external agent gets its own OAuth client (15-minute tokens, no refresh). Agents are OAuth clients, not users — they never appear in your user list. Secrets are shown once at creation or rotation.

Agent	Client id	Created	Last token	Status	Actions

Capability packs

Activation pins an exact version. Overrides change parameters only — rule logic can never be edited here. All changes are audited and versioned.

Try the governed tools

The same tools your agents call — run one yourself and see the governed result envelope come back. Reads are metered; the create tool goes through policy like any agent call.

Pending approvals 0

Out-of-policy intents wait here for a Manager decision. Approvals expire automatically and an approved execution runs exactly once.

Requested	Tool	Agent	Why it needs approval	Expires	Decision

Activity & metering

Every request, policy decision, approval and execution is recorded in an append-only, hash-chained audit trail. Billing counts one unit per governed execution.

0governed executions (month)

0blocked by policy

0went to approval

0active agents

Time	Tool	Agent	Decision	Correlation

Click ⧉ to inspect the governed result envelope returned to the agent.

MCP — Governed agent access

MCP enablement

Agent credentials

Capability packs

Try the governed tools

Pending approvals 0

Activity & metering

Run tool

Register external agent

Approve request