ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload

AI agent security controls for CISOs

Decide what AI agents may do on your systems, and stop them when you need to.

The Agent Governor is runtime authorization for AI agents: every action is decided by your policy, and you can stop any agent.

Book a demo See it in action Read the docs

Inspect › OverviewLast 30 days

Applications

3 cannot sign in

Open issues

4 critical · 7 high

Overdue findings

10 new

AI agents

34 not governed

Agent actions · 24h

2,710

52 denied

Waiting on you

Stops in force

1 automatic

Agent coverage

8 Inline
3 Routed
2 Identity bound
1 Observed
34 Not governed

34 discovered agents act with no governor in their pathGovern

Agent actions last 24 hours

2,628 Allowed30 Held52 Denied

Inspect › Overview · trend lines on every numberIllustrative data from a Coverbase demo org.

Tiers of control
Stop scopes: agent, person's delegations, target, vendor, org
Risk score on every action
Trail you can verify and export

01 · Coverage

Agents you build and vendor agents

Agents you build send their calls through the governor, so it can allow, hold or deny each action before it happens. A vendor agent that lets an admin add external tools can be pointed at the governor and gets the same decision on each action.

For a vendor agent the governor cannot sit in front of, it suspends the agent's identity in Entra, Okta or Salesforce, or reads the platform's audit log, flags actions your rules forbid and can suspend the agent.

Four tiers of controlFig. 1 · Four tiers of control

Inline
Agents you build
The agent's calls go through the governor over MCP or HTTP. The governor allows, holds or denies before the action happens, then mints a short-lived credential scoped to the action and runs it.
Decides: Every action, before it runs
- MCP
- HTTP
Routed
Vendor agents that accept external tools
A vendor agent that lets an admin register external tools or MCP servers is pointed at the governor, which turns its calls into inline traffic.
Decides: Every action, once routed
- Copilot Studio
- Agentforce
- Claude
Identity bound
Vendor agents the governor cannot sit in front of
The governor suspends the agent's identity and revokes its grants.
Decides: The agent's identity
- Entra
- Okta
- Salesforce
Observed
Vendor agents acting inside their own product
The governor reads the platform's audit log every 2, 5, 15 or 60 minutes, flags an action your rules forbid, and can suspend the agent.
Decides: After the fact
- Microsoft Entra
- Okta
- Salesforce
- Microsoft Purview

Each agent sits in the strongest tier its deployment allows.

Data

Tier	Fits	Governor decides	Named platforms
Inline	Agents you build	Every action, before it runs	MCP, HTTP
Routed	Vendor agents that accept external tools	Every action, once routed	Copilot Studio, Agentforce, Claude
Identity bound	Vendor agents the governor cannot sit in front of	The agent's identity	Entra, Okta, Salesforce
Observed	Vendor agents acting inside their own product	After the fact	Microsoft Entra, Okta, Salesforce, Microsoft Purview

Routed

a vendor agent that lets an admin register external tools or MCP servers (Copilot Studio, Agentforce, Claude) is pointed at the governor, which turns its calls into inline traffic.

Identity bound

for a vendor agent the governor cannot sit in front of, the governor suspends its identity in Entra, Okta or Salesforce and revokes its grants.

Observed

for a vendor agent acting entirely inside its own product, the governor reads the platform's audit log (Microsoft Entra, Okta, Salesforce or Microsoft Purview, every 2, 5, 15 or 60 minutes), flags an action your rules forbid, and can suspend the agent.

Inspect › Governor › Agents › Vendor connections

Microsoft Entra
Reads the audit log every 2 minutes
Sync now
Okta
Reads the audit log every 15 minutes
Sync now
Salesforce
Reads the audit log every 15 minutes
Sync now
Microsoft Purview
Reads the audit log every 60 minutes
Sync now

A flagged action names the rule it broke. Suspend the agent from the same row.

Vendor connections. The observed tier reads each platform's audit log every 2, 5, 15 or 60 minutes. Pick an interval to change it. Illustrative data from a Coverbase demo org.

02 · Stop

Stop one agent or every agent, and revoke its live credentials.

Stop one agent, one person's delegations, one target, one vendor or the whole org. Live credentials are revoked. The stop applies at the next decision, and you lift it from the banner when the incident is over.

Automatic stop rules do the same without a person. An agent that racks up denied actions is stopped and its credentials are revoked.

Inspect › Governor

copilot-studio-hr is stopped · automatically · 10 denied actions in 5 minutes · 1 credential revoked

Stop agents

The stop applies at the next decision. Live credentials are revoked.

Stop agents. Choose a scope and press Stop. The banner on top is an automatic stop from the demo org. Illustrative data from a Coverbase demo org.

Inspect › Governor › Agents › copilot-studio-hr

Tier: Identity bound
Signs in with: Vendor identity
State: Stopped automatically

Guardrails

Stop after denied actions

Denials within five minutes that stop the agent and revoke its credentials.

Actions per minute

120

Over the limit, actions are denied until the minute rolls over.

Automatic stop. Each agent carries guardrails: a stop after repeated denials and a limit on actions per minute.

03 · Approvals

High-risk actions wait until one or two people approve them.

Held actions wait for a person. Two-person approval is available. Your policy sets which actions are held, and the approver decides whether each one runs.

Inspect › Governor

support-copilot · zendesk-apiHoldTwo-person approval
POST /api/v2/tickets/48211/refund
62Held · Hold threshold4m ago
reporting-bot · analytics-dbHold
COPY (SELECT * FROM public.orders) TO STDOUT
60Held · Exports need a person1m ago

J nextK previousA approveD deny

Approvals. Press Approve once on the refund to see the two-person hold move to 1 of 2. Illustrative data from a Coverbase demo org.

Nothing runs until a person approves

A held action waits in Approvals. The agent gets no credential while it waits.

Approve once means that action only

Approve once runs that exact action. A window covers equal actions until it closes.

Two people above a risk you choose

A two-person hold shows 1 of 2 until a second, different person approves.

The right people get the page

Held actions page the agent's owner and governor admins.

04 · Board view

One overview for applications, findings, AI agents, approvals and stops.

One Inspect overview for applications, findings, AI agents, approvals and stops, with trend lines on every number. Read the band left to right, then work the queue: each row has the button that fixes it.

Inspect pages work on phones, so an approver can decide a held action away from a desk.

Inspect › Overview

What needs you10

Governor
2 agent actions are waiting on a person
Review
Governor
1 stop is in force
1 automatic
Review
Governor
1 governor target has no rules
Every action on it is denied until a rule permits it
Add rules
Inspect
3 applications cannot sign in
Fix sign-in
AI agents
6 agents can write with no person approving
Found by inspections of your applications
Review
AI agents
1 application has no way to stop its agents
Review
AI agents
34 discovered agents are not governed
Discovered agents with no governor in their path
Govern
Findings
4 overdue findings
Review
Inspect
2 inspections did not finish
Open
Inspect
12 applications have never been inspected
Inspect

What needs you. Governor decisions sit in the same queue as application inspections and findings. Illustrative data from a Coverbase demo org.

Inspect › Governor

support-copilot · zendesk-apiHold
POST /api/v2/tickets/48211/refund
62Held · Hold threshold4m ago
reporting-bot · analytics-dbHold
COPY (SELECT * FROM public.orders) TO STDOUT
60Held · Exports need a person1m ago

J nextK previousA approveD deny

Approvals on a phone. Decide a held action away from a desk.

05 · Evidence

Audit log of every agent action

Every decision is logged in a tamper-evident audit log that you can export. When the board or an auditor asks what an agent did, you show the event and prove nobody edited it.

The governor is an identity provider for agents. It issues short-lived signed tokens that name the agent and the person it acts for, verifiable against your org's published keys.

Who signed in
The person it acted for
The classification and risk score
The rule that decided
What ran
What was masked
The credential revoke

Tamper-evident trailFig. 2 · Tamper-evident trail

Inspect › Governor › Activity

#4117Allowreporting-bot · analytics-db · SELECT region, sum(total)prev 52ab09d39f2c41e7
#4118Holdreporting-bot · analytics-db · COPY public.orders TO STDOUTprev 9f2c41e7c07e5a12
#4119Denyops-agent · analytics-db · DROP TABLE public.refundsprev c07e5a123b8d6f90
#4120Allowops-agent · aws-prod · ec2:DescribeInstancesprev 3b8d6f90e41a7c58

Each hash names the event before it.

Each event carries its own hash and the hash of the event before it, so an edit anywhere breaks every link after it. Illustrative data from a Coverbase demo org.

Data

Event	Decision	Hash	Previous hash
#4117	Allow	9f2c41e7	52ab09d3
#4118	Hold	c07e5a12	9f2c41e7
#4119	Deny	3b8d6f90	c07e5a12
#4120	Allow	e41a7c58	3b8d6f90

More on the governor.

06 · Open work

What the governor does not do.

The observed tier acts after the fact

For a vendor agent acting inside its own product, the governor reads the audit log, flags an action your rules forbid and can suspend the agent. It cannot stop that single action before it happens.

The identity bound tier acts on the agent, not the action

When the governor cannot sit in front of a vendor agent, it suspends the agent's identity in Entra, Okta or Salesforce and revokes its grants. It does not decide each action that agent takes.

A mapping is not a certification

Each policy set is mapped to requirements in 12 frameworks. Mapping a set to SOC 2 or ISO/IEC 42001 does not make you compliant. Your auditor still assesses your controls.

See the governor work with your own agents.

Bring an agent your team built and one a vendor runs. We put the governor in front of both, stop one, and walk through the trail with you.

See it in action Read the docs