ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload

Runtime authorization for AI agents.

The Agent Governor checks each action an AI agent tries to take on your systems, then allows it, holds it for a person to approve, or denies it. Each decision is recorded in a tamper-evident trail.

Book a demo See it in action Read the docs

Inspect › GovernorStop agents

Live decisionsLive

Time	Verdict	Agent	Target	Action	Risk
23:57:18	Allow	ops-agent	aws-prod	ec2:DescribeInstances	8
23:57:16	Allow	reporting-bot	analytics-db	SELECT name, email, total FROM payments	10
23:57:14	Hold	support-copilot	zendesk-api	POST /api/v2/tickets/48211/refund	62
23:57:12	Deny	copilot-studio-hr	aws-prod	iam:CreateRoleAssignment	88
23:57:10	Allow	reporting-bot	analytics-db	UPDATE invoices SET paid = true	30
23:57:08	Hold	reporting-bot	analytics-db	COPY public.orders TO STDOUT	60
23:57:06	Allow	ops-agent	bastion	systemctl status nginx	12

Inspect › Governor · Command centerIllustrative data from a Coverbase demo org.

Risk score on every action
Tiers of control
Policy sets mapped to 12 frameworks
Decisions replayed before you save

01 · How it decides

Risk scoring and policy checks on every action

Every action is classified by intent, scored for risk from 0 to 100, and decided by policy. The governor issues a credential for the action only after it is allowed.

The decision pathFig. 1 · The decision path

01Authenticate agentThe agent presents its key, OAuth grant or workload identity.
02Resolve personThe governor names the person the agent acts for.
03Normalize actionSQL, shell, cloud and API calls become one action shape.
04Classify intent and riskIntent is classified and risk is scored from 0 to 100.
05Evaluate policyOrg settings and policy sets decide. If rules conflict, the strictest one applies.
06Hold or proceedA held action waits for a person.
07Mint and executeA short-lived credential scoped to the action, then the action runs.
08Mask, record, releaseSensitive values are masked, the decision is recorded, the result is released.

The eight steps the governor takes for every action, in order. The credential exists only after policy has decided.

Data

Step	What happens
1. Authenticate agent	The agent presents its key, OAuth grant or workload identity.
2. Resolve person	The governor names the person the agent acts for.
3. Normalize action	SQL, shell, cloud and API calls become one action shape.
4. Classify intent and risk	Intent is classified and risk is scored from 0 to 100.
5. Evaluate policy	Org settings and policy sets decide. If rules conflict, the strictest one applies.
6. Hold or proceed	A held action waits for a person.
7. Mint and execute	A short-lived credential scoped to the action, then the action runs.
8. Mask, record, release	Sensitive values are masked, the decision is recorded, the result is released.

When more than one rule matches

If more than one rule matches an action, the governor uses the strictest. A Forbid rule refuses the action even when a Hold or Permit rule also matches, and a Hold rule sends it to a person even when a Permit rule matches. Turn the rules in the figure on and off to see the decision change.

A prompt injection classifier scores requests, results and MCP tool descriptions. A hit raises the risk score, and a flagged result is masked or withheld.

When rules conflictFig. 4 · Policy effects in order

ForbidNo privilege changes1
HoldExports need a person2
PermitReads3

DecisionForbidRefused before a credential exists.

When more than one rule matches an action, the strictest effect decides. Switch a rule off to see the next one take over. Illustrative data from a Coverbase demo org.

Data

Order	Effect	What happens
1	Forbid	The action is refused
2	Hold	The action waits for a person
3	Permit	The action runs

02 · Coverage

Agents you build and vendor agents

Agents you build send their calls through the governor, so it can allow, hold or deny each action before it happens. A vendor agent that lets an admin add external tools can be pointed at the governor and gets the same per-action decisions. For a vendor agent the governor cannot sit in front of, it suspends the agent's identity or reads the platform's audit log after the fact.

Four tiers of controlFig. 2 · Four tiers of control

Inline
Agents you build
The agent's calls go through the governor over MCP or HTTP. The governor allows, holds or denies before the action happens, then mints a short-lived credential scoped to the action and runs it.
Decides: Every action, before it runs
- MCP
- HTTP
Routed
Vendor agents that accept external tools
A vendor agent that lets an admin register external tools or MCP servers is pointed at the governor, which turns its calls into inline traffic.
Decides: Every action, once routed
- Copilot Studio
- Agentforce
- Claude
Identity bound
Vendor agents the governor cannot sit in front of
The governor suspends the agent's identity and revokes its grants.
Decides: The agent's identity
- Entra
- Okta
- Salesforce
Observed
Vendor agents acting inside their own product
The governor reads the platform's audit log every 2, 5, 15 or 60 minutes, flags an action your rules forbid, and can suspend the agent.
Decides: After the fact
- Microsoft Entra
- Okta
- Salesforce
- Microsoft Purview

Each agent sits in the strongest tier its deployment allows.

Data

Tier	Fits	Governor decides	Named platforms
Inline	Agents you build	Every action, before it runs	MCP, HTTP
Routed	Vendor agents that accept external tools	Every action, once routed	Copilot Studio, Agentforce, Claude
Identity bound	Vendor agents the governor cannot sit in front of	The agent's identity	Entra, Okta, Salesforce
Observed	Vendor agents acting inside their own product	After the fact	Microsoft Entra, Okta, Salesforce, Microsoft Purview

03 · Credentials and data

Short-lived credentials and data masking

The governor keeps the credentials, the gateway runs inside your network, and sensitive values are masked before the model sees a result.

A short-lived credential scoped to the action

The governor holds the credential. For an action it allows, it mints a short-lived credential scoped to that action and runs it. Stop an agent and its live credentials are revoked.

Masking before the model reads the result

Email addresses, phone numbers, government IDs (checksum validated), payment card numbers (Luhn checked), bank account numbers, cloud access keys, private keys, high-entropy strings such as tokens, and any column or field the target owner names. Each masked value becomes a typed placeholder or a stable per-session token, so an agent can still join on a value without seeing it.

A customer gateway with outbound-only connections

The gateway runs inside your network and reaches your private targets. It opens outbound-only connections, and secrets are sealed to it.

Region pins

Pin a target to a region, and actions on it run only in that region, through a gateway there. An action that would run anywhere else is refused before a credential is minted.

Inspect › Governor › Activity › #4116Allow

Agent: reporting-bot · acting for d.reyes
Action: SELECT name, email, total FROM payments
Classified: Read 10
Decided by: Permit Reads · analytics-db
Credential: Short-lived, scoped to this action · revoked after it ran
Masked: email → <EMAIL>

Result the model reads

name	email	total
Northwind Ltd	`<EMAIL>`	12,400.00
Blue Harbor Co	`<EMAIL>`	8,915.50
Fennel & Pike	`<EMAIL>`	3,270.00

hash 52ab09d3 · prev 7d10c4bf

Activity · Decision detail · Illustrative data from a Coverbase demo org.

04 · Approvals and stops

Approvals and emergency stops

Held actions wait for a person. Two-person approval is available. Inspect pages work on phones, so an approver can decide a held action away from a desk.

Stop one agent, one person's delegations, one target, one vendor or the whole org. Live credentials are revoked.

Inspect › Governor

support-copilot · zendesk-apiHoldTwo-person approval
POST /api/v2/tickets/48211/refund
62Held · Hold threshold4m ago
reporting-bot · analytics-dbHold
COPY (SELECT * FROM public.orders) TO STDOUT
60Held · Exports need a person1m ago

J nextK previousA approveD deny

Approvals. Approve once runs that exact action only. A two-person hold shows 1 of 2 until a second, different person approves.

Inspect › Governor

Stop agents

The stop applies at the next decision. Live credentials are revoked.

Stop agents. Five scopes. The stop applies at the next decision and revokes live credentials. Lift it from the banner when the incident is over.

05 · Policy

28 policy sets mapped to 12 frameworks

28 ready-made policy sets with 108 rules. Install a set on a target and edit any rule. Library updates keep the rules you changed.

Preview a settings change against your last 1,000 decisions before you save it.

Policy library coverageFig. 6 · Policy library coverage

SOC 2ISO 27001ISO 42001NIST 800-53NIST AI RMFOWASP LLMEU AI ActGDPRHIPAAPCI DSSDORASOX ITGC

28 policy sets by 12 frameworks; larger dots map to more requirements. See the full library →

Data

Policy set	Category	Rules	SOC 2	ISO/IEC 27001:2022	ISO/IEC 42001:2023	NIST SP 800-53 Rev. 5	NIST AI RMF 1.0	OWASP Top 10 for LLM Applications 2025	EU AI Act	GDPR	HIPAA Security Rule	PCI DSS v4.0	DORA	SOX ITGC
Read only	Foundations	3	2	2	0	1	0	1	0	0	0	0	0	0
Least privilege starter	Foundations	5	2	2	1	1	1	1	1	0	0	0	0	0
Production operator	Foundations	5	3	3	0	2	0	1	0	0	0	0	0	1
Human in the loop	Foundations	4	1	1	1	1	1	1	1	0	0	0	0	1
On behalf of a person only	Foundations	4	2	2	1	1	1	1	1	0	0	0	0	0
Analytics and reporting	Foundations	4	3	3	0	2	0	2	0	0	0	0	0	0
Customer support desk	Foundations	5	0	1	1	0	1	2	1	3	0	0	0	0
CI/CD and deployment agents	Foundations	5	3	3	0	2	0	1	0	0	0	0	0	1
Sandbox and test	Foundations	3	2	2	0	1	0	1	0	0	0	0	0	0
Essential agent guardrails	Essentials	3	2	3	1	2	1	1	1	0	0	0	0	0
No destructive operations	Essentials	3	1	2	0	2	0	0	0	0	0	0	1	1
Data loss prevention	Essentials	4	1	2	0	1	0	1	0	3	0	0	0	0
Secrets and credentials	Security	4	2	3	0	2	0	1	0	0	0	0	0	0
Personal data protection	Data protection	4	1	2	0	1	0	1	0	3	0	0	0	0
Payroll and HR records	Data protection	2	2	3	0	1	0	2	0	3	0	0	0	0
Cardholder data (PCI DSS)	Data protection	3	1	1	0	1	0	1	0	0	0	3	0	0
Health information (HIPAA)	Data protection	2	0	1	0	0	0	1	0	3	3	0	0	0
Financial reporting controls (SOX)	Financial controls	4	3	2	0	3	0	0	1	0	0	0	0	2
Trading and treasury	Financial controls	3	1	0	1	1	1	1	1	0	0	0	0	1
Identity and SaaS admin safety	Security	4	2	3	0	2	0	1	0	0	0	0	0	0
Protect security tooling	Security	3	1	2	0	2	0	0	1	0	0	0	1	0
Change management	Infrastructure	2	2	2	0	2	0	0	1	0	0	0	0	1
AWS control plane	Infrastructure	5	3	3	0	2	0	1	0	0	0	0	0	1
Kubernetes clusters	Infrastructure	9	3	4	0	3	0	1	0	0	0	0	0	1
Server shell access	Infrastructure	7	3	3	0	2	0	1	0	0	0	0	0	1
Code sandboxes	Infrastructure	4	3	3	1	2	1	2	1	0	0	0	0	0
Third-party and vendor agents	Third parties and oversight	2	2	2	2	1	1	2	1	0	0	0	1	0
High-risk AI oversight (EU AI Act)	Third parties and oversight	2	1	1	1	1	1	1	2	0	0	0	0	0
Sets mapped		108	26	27	9	26	9	24	12	5	1	1	3	10

What this would changeFig. 5 · Impact preview

Edit ruleanalytics-db

Highest risk it permits40Priority50

If you save this

200 recent decisions on analytics-db3 would be denied1 held0 allowed

#4120 SELECT * FROM payroll.salaries · allow → deny

4 decisions were stopped or failed before policy and are left out.

CancelSave rule

Saving a rule replays recent decisions on its target first. A change to organization settings replays your last 1,000 decisions. Illustrative data from a Coverbase demo org.

Data

Replayed decisions	Would be denied	Would be held	Would be allowed	Left out
200 on analytics-db	3	1	0	4

See all 28 policy sets

06 · MCP

MCP server discovery and audits

MCP server discovery finds the servers on your people's machines. Each one is listed once, however many machines it is on, checked for poisoning and audited read-only.

Discovery and poisoning checks

The scanner reads MCP configs from six clients. Env values never leave the machine. Tool descriptions are checked for hidden directives, instruction overrides, credential requests, exfiltration, tool shadowing and invisible characters. Approving a server pins its tools, and a later change sends it back to review.

Claude Desktop
Claude Code
Cursor
VS Code
Windsurf
Gemini CLI

Inspect › Governor

weatherTools changed3 flags from the poisoning checkReview
notes-helperTool shadowing flaggedReview

A read-only audit, with drift between audits

The audit calls only tools it can show only read, with small inputs built from their schemas, at most 80 calls per server. Audits rerun on a schedule and show what changed from the last one.

What each tool does: Reads, changes data, deletes, or unclear. Unclear tools are never called.
What the reads return: The kinds of data each read returned, counted, never the values.
Sign-in: How the server signs people in, and the scopes it asks for.
Drift: What changed since the last audit.

MCP server security

07 · Audit log

Audit log

Every agent action is logged with who signed in, who the agent acted for, how the action was classified, the rule that applied, what ran and what was masked. Each entry includes the hash of the entry before it, so you can check that nothing was changed, and you can export the log.

The governor is an identity provider for agents. Its short-lived signed tokens name the agent and the person it acts for, verifiable against your org's published keys.

Tamper-evident trailFig. 9 · Tamper-evident trail

Inspect › Governor › Activity

#4117Allowreporting-bot · analytics-db · SELECT region, sum(total)prev 52ab09d39f2c41e7
#4118Holdreporting-bot · analytics-db · COPY public.orders TO STDOUTprev 9f2c41e7c07e5a12
#4119Denyops-agent · analytics-db · DROP TABLE public.refundsprev c07e5a123b8d6f90
#4120Allowops-agent · aws-prod · ec2:DescribeInstancesprev 3b8d6f90e41a7c58

Each hash names the event before it.

Each event carries its own hash and the hash of the event before it, so an edit anywhere breaks every link after it. Illustrative data from a Coverbase demo org.

Data

Event	Decision	Hash	Previous hash
#4117	Allow	9f2c41e7	52ab09d3
#4118	Hold	c07e5a12	9f2c41e7
#4119	Deny	3b8d6f90	c07e5a12
#4120	Allow	e41a7c58	3b8d6f90

Pages for each team

08 · Open work

What the governor does not do.

The observed tier acts after the fact

For a vendor agent acting inside its own product, the governor reads the audit log, flags an action your rules forbid and can suspend the agent. It cannot stop that single action before it happens.

The identity bound tier acts on the agent, not the action

When the governor cannot sit in front of a vendor agent, it suspends the agent's identity in Entra, Okta or Salesforce and revokes its grants. It does not decide each action that agent takes.

A mapping is not a certification

Each policy set is mapped to requirements in 12 frameworks. Mapping a set to SOC 2 or ISO/IEC 42001 does not make you compliant. Your auditor still assesses your controls.

09 · Questions

Frequently asked questions

What is runtime authorization for AI agents?

Runtime authorization for AI agents decides each action an agent takes at the moment it tries to take it. The Agent Governor classifies the action by intent, scores its risk from 0 to 100 and decides it by policy: allow it, hold it for a person, or deny it. Every decision is logged in a tamper-evident audit log that you can export.

Which agents can the governor govern?

Agents you build and agents your vendors run. Each agent sits in the strongest of four tiers its deployment allows. Inline: its calls go through the governor over MCP or HTTP and are decided before they run. Routed: a vendor agent such as Copilot Studio, Agentforce or Claude is pointed at the governor, which turns its calls into inline traffic. Identity bound: the governor suspends the agent's identity in Entra, Okta or Salesforce and revokes its grants. Observed: the governor reads the platform's audit log, flags an action your rules forbid and can suspend the agent.

Does the governor see my secrets?

Secrets are sealed to the customer gateway, which runs inside your network with outbound-only connections. For an action the governor allows, it mints a short-lived credential scoped to that action and runs it, so the agent holds no standing secret.

Which MCP clients does it support?

Claude Desktop and other MCP clients sign in with OAuth 2.1 and PKCE. A person approves, and the client acts for them for 1, 7, 30 or 90 days. MCP server discovery reads configs from Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and Gemini CLI, and env values never leave the machine.

Which frameworks does the policy library map to?

The library has 28 ready-made policy sets with 108 rules, mapped to 12 frameworks: SOC 2, ISO/IEC 27001:2022, ISO/IEC 42001:2023, NIST SP 800-53 Rev. 5, NIST AI RMF 1.0, OWASP Top 10 for LLM Applications 2025, EU AI Act, GDPR, HIPAA Security Rule, PCI DSS v4.0, DORA and SOX ITGC. Library updates keep the rules you changed.

Book a demo with one of your own agents.

Bring an agent you run or one your vendor runs. We connect it to the governor and go through each decision with you.

See it in action Read the docs