The Agent Governor is runtime authorization for AI agents: it mints a short-lived credential scoped to each action and runs it.
Governor key for demo-agent Copy
cbbk.cbbagt_7c1e2d.pXq3vN8rT2mK6wY1zL4hB9cF0sJ5dA1F9
Shown once. Anyone with it can act as this agent, within its policy.
claude mcp add --transport http coverbase \
https://governor.example.coverbase.app/mcp \
--header "Authorization: Bearer $COVERBASE_GOVERNOR_KEY"Set the key as COVERBASE_GOVERNOR_KEY where the agent runs. Each target becomes a tool.
Or skip the key: add this URL as a remote MCP server and sign in with your Coverbase account.
https://governor.example.coverbase.app/mcp
Try these, in order
Waiting for demo-agent's first call
Agents connect the way they already work. However they connect, each action goes through the same policy check, and the agent never holds the target's credential.
Point an MCP client at the governor over Streamable HTTP. It signs in with a governor key, and each target becomes a tool. Agents that do not speak MCP call the same governor over HTTP.
https://governor.example.coverbase.app/mcp
Example endpoint
Claude Desktop and other MCP clients sign in with OAuth 2.1 and PKCE. A person approves, and the client acts for them for 1, 7, 30 or 90 days. Allowing creates a delegation from that person, and no key sits in the client's config.
Claude Desktop wants to act as an agent for you
Act as
A new agent named Claude Desktop
For
Workload identity takes OIDC from your CI or cloud issuer, or SPIFFE with a trust domain, its JWKS and a SPIFFE ID pattern. For CI, choose workload identity so no secret lives in the repository.
Signs in with workload identity
No key to store. Nothing secret lives in the repository.
{
"mcpServers": {
"coverbase": {
"type": "http",
"url": "https://governor.example.coverbase.app/mcp",
"headers": {
"Authorization": "Bearer ${COVERBASE_GOVERNOR_KEY}"
}
}
}
}The governor issues short-lived signed tokens that name the agent and the person it acts for. Any service verifies them against your org's published keys.
Every action is classified by intent, scored for risk from 0 to 100, and decided by policy. If more than one rule matches an action, the strictest one applies: a Forbid rule refuses the action even when a Hold or Permit rule also matches. The rules live in the governor, so agent code needs no hand-built allow lists.
The eight steps the governor takes for every action, in order. The credential exists only after policy has decided.
| Step | What happens |
|---|---|
| 1. Authenticate agent | The agent presents its key, OAuth grant or workload identity. |
| 2. Resolve person | The governor names the person the agent acts for. |
| 3. Normalize action | SQL, shell, cloud and API calls become one action shape. |
| 4. Classify intent and risk | Intent is classified and risk is scored from 0 to 100. |
| 5. Evaluate policy | Org settings and policy sets decide. If rules conflict, the strictest one applies. |
| 6. Hold or proceed | A held action waits for a person. |
| 7. Mint and execute | A short-lived credential scoped to the action, then the action runs. |
| 8. Mask, record, release | Sensitive values are masked, the decision is recorded, the result is released. |
Refused at step 5. No credential is ever minted.
Waits at step 6. No credential exists until a person approves.
At step 7 the governor mints a short-lived credential scoped to the action, then the action runs.
The gateway runs inside your network with outbound-only connections. Secrets are sealed to the gateway. The governor decides in Coverbase, and the gateway runs the action next to your target.
Your network
Customer gateway
Runs actions on private targets.
Secrets sealed here
Inbound ports open: 0
Coverbase
Agent Governor
Decides each action, then sends it to the gateway to run.
The gateway runs inside your network, reaches your private targets, and opens one outbound-only connection to Coverbase. Secrets are sealed to the gateway. Target names are illustrative.
| Part | Where it runs | Connections |
|---|---|---|
| Agent Governor | Coverbase | Accepts the gateway's outbound connection |
| Customer gateway | Your network | Outbound only, to Coverbase |
| Private targets | Your network | Reached by the gateway only |
| Secrets | Your network | Sealed to the gateway |
Pin a target to a region, and actions on it run only in that region, through a gateway there. An action that would run anywhere else is refused before a credential is minted.
A one-time enrollment token adds the gateway. From then on it dials out to Coverbase, so you open no inbound port.
The governor masks sensitive values in each result before the model reads it. Each masked value becomes a typed placeholder or a stable per-session token.
The same filter screens requests leaving for an outside service.
| Type | Before | After, what the model reads |
|---|---|---|
| Email address | dana.reyes@acme-finance.example | <EMAIL> |
| Phone number | +1 415 555 0142 | <PHONE> |
| Government ID (checksum validated) | 078-05-1120 | <GOV_ID> |
| Payment card number (Luhn checked) | 4111 1111 1111 1111 | <CARD> |
| Bank account number | GB82 WEST 1234 5698 7654 32 | <BANK_ACCOUNT> |
| Cloud access key | AKIAIOSFODNN7EXAMPLE | <CLOUD_KEY> |
| Private key | -----BEGIN PRIVATE KEY----- MIIEv… | <PRIVATE_KEY> |
| High-entropy string such as a token | ghp_8fK2xQ9vLm4TzR7wYc1NbA6sPe3UdH0jGo5i | <SECRET> |
| Named column | customers.date_of_birth = 1984-03-17 | tok_7c1e9a |
One row per masked type. The named column row shows a stable per-session token: the agent can still join on the value without seeing it. Values are fictional.
| Type | Before | After |
|---|---|---|
| Email address | dana.reyes@acme-finance.example | <EMAIL> |
| Phone number | +1 415 555 0142 | <PHONE> |
| Government ID (checksum validated) | 078-05-1120 | <GOV_ID> |
| Payment card number (Luhn checked) | 4111 1111 1111 1111 | <CARD> |
| Bank account number | GB82 WEST 1234 5698 7654 32 | <BANK_ACCOUNT> |
| Cloud access key | AKIAIOSFODNN7EXAMPLE | <CLOUD_KEY> |
| Private key | -----BEGIN PRIVATE KEY----- MIIEv… | <PRIVATE_KEY> |
| High-entropy string such as a token | ghp_8fK2xQ9vLm4TzR7wYc1NbA6sPe3UdH0jGo5i | <SECRET> |
| Named column | customers.date_of_birth = 1984-03-17 | tok_7c1e9a |
The agent can still join on the value without seeing it, because the same value gets the same token for the whole session.
Government IDs are checksum validated and card numbers are Luhn checked before they are masked. Target owners add any column or field by name.
A prompt injection classifier (Amazon Bedrock Guardrails plus a local model) scores requests, results and MCP tool descriptions. A hit raises the risk score. A flagged result is masked or withheld.
The sandbox is built in. One click creates the target and a demo agent, so you can watch each decision before you connect a real system.
Decision
Allow
Runs with a one-time role.
Emails and card numbers in the rows come back masked before the model reads them.
For a vendor agent acting inside its own product, the governor reads the audit log, flags an action your rules forbid and can suspend the agent. It cannot stop that single action before it happens.
When the governor cannot sit in front of a vendor agent, it suspends the agent's identity in Entra, Okta or Salesforce and revokes its grants. It does not decide each action that agent takes.
Each policy set is mapped to requirements in 12 frameworks. Mapping a set to SOC 2 or ISO/IEC 42001 does not make you compliant. Your auditor still assesses your controls.
Bring an agent you are building. We connect it to the governor, run it against the sandbox, and show you each decision and the credential behind it.