A mapping is not a certification
Each policy set is mapped to requirements in 12 frameworks. Mapping a set to SOC 2 or ISO/IEC 42001 does not make you compliant. Your auditor still assesses your controls.
ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload
Agent controls mapped to the frameworks you report on.
The Agent Governor is runtime authorization for AI agents. Install policy sets mapped to your frameworks, preview what they would change, and export the evidence.
Ready-made sets mapped to SOC 2, ISO 27001, ISO 42001, the EU AI Act and more. Install one to get your own copy.
Policy set library · Foundations decide what agents may do on a target; guardrails only make decisions stricter.
Read only★
FoundationAgents may look, never touch.
Forbid 1Permit 2
SOC 2ISO 27001NIST 800-53+1
v1 · 3 rules
Least privilege starter★
FoundationLow-risk reads run; changes and exports wait for a person.
Forbid 1Hold 2Permit 2
SOC 2ISO 27001ISO 42001+4
v1 · 5 rulesUpdate available
Production operator
FoundationRoutine work runs; destructive and structural changes do not.
Forbid 1Hold 2Permit 2
SOC 2ISO 27001NIST 800-53+2
v1 · 5 rules
Human in the loop
FoundationEvery change waits for a person; reads run.
Forbid 1Hold 1Permit 2
SOC 2ISO 27001ISO 42001+5
v1 · 4 rules
On behalf of a person only
FoundationThe agent acts only while a person has delegated to it.
Forbid 1Hold 1Permit 2
SOC 2ISO 27001ISO 42001+4
v1 · 4 rules
Analytics and reporting
FoundationQuery freely, export with approval, change nothing.
Forbid 1Hold 1Permit 2
SOC 2ISO 27001NIST 800-53+1
v1 · 4 rules
Showing 6 of 28 sets
- Policy sets
- Frameworks mapped
- Decisions replayed per preview
- Exportable trail
Start from 28 ready-made policy sets.
The library holds 28 policy sets with 108 rules, each mapped to requirements in 12 frameworks. Install a set to get your own copy, then assign it to the targets it should govern.
Foundations decide what agents may do on a target. Guardrails only make decisions stricter.
Frameworks mapped
- SOC 2
- ISO/IEC 27001:2022
- ISO/IEC 42001:2023
- NIST SP 800-53 Rev. 5
- NIST AI RMF 1.0
- OWASP Top 10 for LLM Applications 2025
- EU AI Act
- GDPR
- HIPAA Security Rule
- PCI DSS v4.0
- DORA
- SOX ITGC
Library categories
- Foundations9
- Essentials3
- Security3
- Data protection4
- Financial controls2
- Infrastructure5
- Third parties and oversight2
Scroll sideways for more →
| Read only | 3 | 2 | 2 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Least privilege starter | 5 | 2 | 2 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| Production operator | 5 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Human in the loop | 4 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 1 |
| On behalf of a person only | 4 | 2 | 2 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| Analytics and reporting | 4 | 3 | 3 | 0 | 2 | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 0 |
| Customer support desk | 5 | 0 | 1 | 1 | 0 | 1 | 2 | 1 | 3 | 0 | 0 | 0 | 0 |
| CI/CD and deployment agents | 5 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Sandbox and test | 3 | 2 | 2 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Essential agent guardrails | 3 | 2 | 3 | 1 | 2 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| No destructive operations | 3 | 1 | 2 | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 1 |
| Data loss prevention | 4 | 1 | 2 | 0 | 1 | 0 | 1 | 0 | 3 | 0 | 0 | 0 | 0 |
| Secrets and credentials | 4 | 2 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Identity and SaaS admin safety | 4 | 2 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Protect security tooling | 3 | 1 | 2 | 0 | 2 | 0 | 0 | 1 | 0 | 0 | 0 | 1 | 0 |
| Personal data protection | 4 | 1 | 2 | 0 | 1 | 0 | 1 | 0 | 3 | 0 | 0 | 0 | 0 |
| Payroll and HR records | 2 | 2 | 3 | 0 | 1 | 0 | 2 | 0 | 3 | 0 | 0 | 0 | 0 |
| Cardholder data (PCI DSS) | 3 | 1 | 1 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 3 | 0 | 0 |
| Health information (HIPAA) | 2 | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 3 | 3 | 0 | 0 | 0 |
| Financial reporting controls (SOX) | 4 | 3 | 2 | 0 | 3 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 2 |
| Trading and treasury | 3 | 1 | 0 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 1 |
| Change management | 2 | 2 | 2 | 0 | 2 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 1 |
| AWS control plane | 5 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Kubernetes clusters | 9 | 3 | 4 | 0 | 3 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Server shell access | 7 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Code sandboxes | 4 | 3 | 3 | 1 | 2 | 1 | 2 | 1 | 0 | 0 | 0 | 0 | 0 |
| Third-party and vendor agents | 2 | 2 | 2 | 2 | 1 | 1 | 2 | 1 | 0 | 0 | 0 | 1 | 0 |
| High-risk AI oversight (EU AI Act) | 2 | 1 | 1 | 1 | 1 | 1 | 1 | 2 | 0 | 0 | 0 | 0 | 0 |
| Sets mapped | 108 | 26 | 27 | 9 | 26 | 9 | 24 | 12 | 5 | 1 | 1 | 3 | 10 |
Each dot is the number of requirements in that framework a policy set maps to; no dot means none. The bottom row counts the sets mapped to each framework. Exported from the policy library on November 5, 2026. A mapping is not a certification.
Data
| Policy set | Category | Rules | SOC 2 | ISO/IEC 27001:2022 | ISO/IEC 42001:2023 | NIST SP 800-53 Rev. 5 | NIST AI RMF 1.0 | OWASP Top 10 for LLM Applications 2025 | EU AI Act | GDPR | HIPAA Security Rule | PCI DSS v4.0 | DORA | SOX ITGC |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Read only | Foundations | 3 | 2 | 2 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Least privilege starter | Foundations | 5 | 2 | 2 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| Production operator | Foundations | 5 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Human in the loop | Foundations | 4 | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 1 |
| On behalf of a person only | Foundations | 4 | 2 | 2 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| Analytics and reporting | Foundations | 4 | 3 | 3 | 0 | 2 | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 0 |
| Customer support desk | Foundations | 5 | 0 | 1 | 1 | 0 | 1 | 2 | 1 | 3 | 0 | 0 | 0 | 0 |
| CI/CD and deployment agents | Foundations | 5 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Sandbox and test | Foundations | 3 | 2 | 2 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Essential agent guardrails | Essentials | 3 | 2 | 3 | 1 | 2 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
| No destructive operations | Essentials | 3 | 1 | 2 | 0 | 2 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 1 |
| Data loss prevention | Essentials | 4 | 1 | 2 | 0 | 1 | 0 | 1 | 0 | 3 | 0 | 0 | 0 | 0 |
| Secrets and credentials | Security | 4 | 2 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Personal data protection | Data protection | 4 | 1 | 2 | 0 | 1 | 0 | 1 | 0 | 3 | 0 | 0 | 0 | 0 |
| Payroll and HR records | Data protection | 2 | 2 | 3 | 0 | 1 | 0 | 2 | 0 | 3 | 0 | 0 | 0 | 0 |
| Cardholder data (PCI DSS) | Data protection | 3 | 1 | 1 | 0 | 1 | 0 | 1 | 0 | 0 | 0 | 3 | 0 | 0 |
| Health information (HIPAA) | Data protection | 2 | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 3 | 3 | 0 | 0 | 0 |
| Financial reporting controls (SOX) | Financial controls | 4 | 3 | 2 | 0 | 3 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 2 |
| Trading and treasury | Financial controls | 3 | 1 | 0 | 1 | 1 | 1 | 1 | 1 | 0 | 0 | 0 | 0 | 1 |
| Identity and SaaS admin safety | Security | 4 | 2 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
| Protect security tooling | Security | 3 | 1 | 2 | 0 | 2 | 0 | 0 | 1 | 0 | 0 | 0 | 1 | 0 |
| Change management | Infrastructure | 2 | 2 | 2 | 0 | 2 | 0 | 0 | 1 | 0 | 0 | 0 | 0 | 1 |
| AWS control plane | Infrastructure | 5 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Kubernetes clusters | Infrastructure | 9 | 3 | 4 | 0 | 3 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Server shell access | Infrastructure | 7 | 3 | 3 | 0 | 2 | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Code sandboxes | Infrastructure | 4 | 3 | 3 | 1 | 2 | 1 | 2 | 1 | 0 | 0 | 0 | 0 | 0 |
| Third-party and vendor agents | Third parties and oversight | 2 | 2 | 2 | 2 | 1 | 1 | 2 | 1 | 0 | 0 | 0 | 1 | 0 |
| High-risk AI oversight (EU AI Act) | Third parties and oversight | 2 | 1 | 1 | 1 | 1 | 1 | 1 | 2 | 0 | 0 | 0 | 0 | 0 |
| Sets mapped | 108 | 26 | 27 | 9 | 26 | 9 | 24 | 12 | 5 | 1 | 1 | 3 | 10 |
Library updates keep the rules you changed.
When Coverbase publishes a new version of a set, your installed copy says so. You choose when to take it, and the rules you tuned for your own controls stay as you left them.
FoundationFrom the library, version 1
Version 2 is available (you have 1)
1 added, 1 changed, 0 removed. 1 rule you changed is kept as it is.
Description
A safe first policy for a new target. Low-risk reads run. Writes, deletes and data exports wait for a person. Privilege and credential changes are refused. Anything not covered, such as a schema change, is denied.
5 rules
- PermitAgents may reach the targetBaseline
- ForbidForbid privilege and credential changes
- HoldHold data exportsChanged by you
- HoldHold writes and deletes
- PermitPermit low-risk reads
Changes are counted before you update
The set shows how many rules a new version adds, changes and removes before you update.
Rules you changed are kept
Update brings in the new version. The rules you changed are kept as they are.
Duplicate to stop following the library
Duplicate makes a copy that no longer follows the library, for a set you want to own outright.
See what a change would do before you save it.
Preview a settings change against your last 1,000 decisions before you save it. Saving a rule replays recent decisions on its target first, so you see which past actions would now be denied, held or allowed.
If you save this
200 recent decisions on analytics-db3 would be denied1 held0 allowed
#4120 SELECT * FROM payroll.salaries · allow → deny
4 decisions were stopped or failed before policy and are left out.
CancelSave rule
Saving a rule replays recent decisions on its target first. A change to organization settings replays your last 1,000 decisions. Illustrative data from a Coverbase demo org.
Data
| Replayed decisions | Would be denied | Would be held | Would be allowed | Left out |
|---|---|---|---|---|
| 200 on analytics-db | 3 | 1 | 0 | 4 |
Separation of duties is built into approvals.
Held actions wait for a person. Two-person approval is available. Above a risk score you choose, a held action shows 1 of 2 until a second, different person approves.
- Who may approveHeld actions page the agent's owner and governor admins.
- People you name
- Two people must approve from riskYou choose the risk score, from 0 to 100. Above it, a second, different person must approve.
- Your threshold
- An undecided request expiresA held action nobody decides does not wait forever.
- After the time you set
- Longest window an approval can coverApprove once runs that exact action. A window covers equal actions until it closes.
- The limit you set
J nextK previousA approveD deny
Evidence export for auditors
Every decision is logged in a tamper-evident audit log that you can export. Evidence for an agent control comes from the same record that decided the action.
- #4117Allowreporting-bot · analytics-db · SELECT region, sum(total)prev 52ab09d39f2c41e7
- #4118Holdreporting-bot · analytics-db · COPY public.orders TO STDOUTprev 9f2c41e7c07e5a12
- #4119Denyops-agent · analytics-db · DROP TABLE public.refundsprev c07e5a123b8d6f90
- #4120Allowops-agent · aws-prod · ec2:DescribeInstancesprev 3b8d6f90e41a7c58
Each hash names the event before it.
Each event carries its own hash and the hash of the event before it, so an edit anywhere breaks every link after it. Illustrative data from a Coverbase demo org.
Data
| Event | Decision | Hash | Previous hash |
|---|---|---|---|
| #4117 | Allow | 9f2c41e7 | 52ab09d3 |
| #4118 | Hold | c07e5a12 | 9f2c41e7 |
| #4119 | Deny | 3b8d6f90 | c07e5a12 |
| #4120 | Allow | e41a7c58 | 3b8d6f90 |
- 01
Open Activity
Go to Inspect › Governor › Activity. Every decision the governor made is listed there.
- 02
Filter to the period
Narrow by verdict, agent or target to the actions your auditor asked about.
- 03
Verify the whole trail
Press Verify whole trail. Each event's hash is checked against the one before it.
- 04
Export
Export the events and hand your auditor a trail they can check themselves.
More on the governor.
- Agent Governor overviewHow the governor decides, the four tiers, credentials, approvals, policy, MCP and the trail.
- For CISOsOne control point for every AI agent, a stop for every agent, and a trail an auditor accepts.
- For platform and AI engineeringShip agents without standing credentials. Connect over MCP, HTTP or workload identity.
- MCP server securityFind every MCP server on your machines, check tool descriptions for poisoning, and audit each server read-only.
- Policy library28 agent policy sets and 108 rules, mapped to 12 frameworks.
What the governor does not do.
The observed tier acts after the fact
For a vendor agent acting inside its own product, the governor reads the audit log, flags an action your rules forbid and can suspend the agent. It cannot stop that single action before it happens.
The identity bound tier acts on the agent, not the action
When the governor cannot sit in front of a vendor agent, it suspends the agent's identity in Entra, Okta or Salesforce and revokes its grants. It does not decide each action that agent takes.
Walk through the policy library and trail with us.
Tell us which frameworks you report on. We install the matching policy sets on a test target, preview them against recent decisions, and export the trail with you.