9 of 9 requirements
Export view:Agent & MCP Governance
AGT · 9Govern tool calls at read, write and delete scope
Permit a read while refusing write, delete or other destructive actions, with every attempt logged and attributable.
- Why it matters
- One agent can read, write and delete in the same workflow. Allow or deny per app is too blunt.
- How to verify
- Reads to a connected system are allowed while attempts to change or delete information are blocked.
Area: Agent & MCP Governance
Flag destructive, over-scoped or anomalous agent actions
Detect excessive permissions, unexpected tools, destructive operations, abnormal call sequences and policy bypass.
- Why it matters
- Destructive or unusual agent actions are often the first sign of a hijacked or misconfigured agent.
- How to verify
- A destructive or out-of-pattern tool call in the pilot is flagged with context.
Area: Agent & MCP Governance
Inspect sensitive data retrieved through connectors mid-workflow
Detect when an agent picks up sensitive content from one connnected tool and attemps to share it with a separate tool, even if the user prompt was benign.
- Why it matters
- Connectors pull sensitive data into a conversation even when the user's question is harmless.
- How to verify
- When an agent picks up sensitive information from one tool or dataset and attempts to share it with a different tool, the even is blocked if it violates policy.
Area: Agent & MCP Governance
Attribute every connector and tool call alert to a person
Answer which server and tool were called, by whom, using which identity, every time an alert or intervention fires.
- Why it matters
- Without attribution, an agent action cannot be investigated or tied to accountability.
- How to verify
- Every pilot tool call alert shows the tool used, the surface, the user identity, and the result.
Area: Agent & MCP Governance
Provide targeted containment for a single connector or tool.
Disable or revoke one connector, tool, plugin, or integration for a user or group without switching off the whole AI tool.
- Why it matters
- When one connector misbehaves, switching off the whole AI tool punishes everyone.
- How to verify
- One connector is disabled for one pilot group while the AI tool keeps working.
Area: Agent & MCP Governance
Discover the MCP servers and connectors employees attach to their AI clients
Inventory local and remote MCP servers reached from desktop, IDE and CLI AI tools with owner, scope and exposure.
- Why it matters
- MCP-capable clients now ship inside IDEs, terminals and desktop apps, and each connector is a new path to corporate data.
- How to verify
- Local and remote MCP servers used by pilot users appear with client, owner, scope and exposure.
Area: Agent & MCP Governance
Map the actions available via each connector.
Show, per connector/MCP server, what actions are available and which are currently enabled.
- Why it matters
- Approving a connector without knowing which actions it exposes and which are enabled leaves the scope of available functionality unclear.
- How to verify
- For three connectors you name, the console lists the actions each exposes and shows which are currently enabled.
Area: Agent & MCP Governance
- AGT-008Walkthrough + Documentation
Support local and remote MCP gateway placement for employee AI clients
Support applicable Windows, macOS and Linux patterns, allow endpoint-integrated or remote placement, and define traffic coverage for each.
- Why it matters
- Different MCP clients need different gateway placements to be covered.
- How to verify
- The vendor shows local and remote MCP gateway placement and documents what each covers.
Area: Agent & MCP Governance
Detect indirect prompt injection in content agents read
Identify malicious instructions from the sources that AI systems are able to read from. Name the originating connector or source, respond before the agent acts where configured, and demonstrate tested coverage and known gaps.
- Why it matters
- A poisoned tool response can turn a trusted agent into an attacker's tool while the user's prompt looks harmless.
- How to verify
- Injected instructions in content returned to pilot users' agents are detected and attributed to their source.
Area: Agent & MCP Governance