10 of 10 requirements
Export view:Risk-score AI tools, connectors and agent workflows
Configurable factors such as vendor location, training on inputs, trust-center availability, account tier, autonomy, data sensitivity and tool power.
- Why it matters
- The risk in an AI tool usually sits in its data-handling terms, which change without the domain changing.
- How to verify
- Risk scores, with sources and factors, for five tools.
Area: AI Security Posture Management
Runtime Guardrails
GRD · 1Support monitor, warn, block, and restrict actions
Set the action per policy and let the policy owner configure the intervention choices and block-page wording including removing any bypass, and record both the evaluation and the action. Support a monitor-first rollout. Where policy permits a user to proceed after a warning, require a business justification before continuing. Do not offer an override where policy disables bypass.
- Why it matters
- A control that can only block drives work onto personal devices. Graduated actions let policy match the risk.
- How to verify
- Pilot users see monitor, warn and block outcomes with your wording, and each action is logged. For a warning policy that permits proceeding, show that the user must enter a business justification before continuing. For a blocking policy configured with no bypass, show that the user cannot override the block.
Area: Runtime Guardrails
Agent & MCP Governance
AGT · 8Govern tool calls at read, write and delete scope
Permit a read while refusing write, delete or other destructive actions, with every attempt logged and attributable.
- Why it matters
- One agent can read, write and delete in the same workflow. Allow or deny per app is too blunt.
- How to verify
- Reads to a connected system are allowed while attempts to change or delete information are blocked.
Area: Agent & MCP Governance
Flag destructive, over-scoped or anomalous agent actions
Detect excessive permissions, unexpected tools, destructive operations, abnormal call sequences and policy bypass.
- Why it matters
- Destructive or unusual agent actions are often the first sign of a hijacked or misconfigured agent.
- How to verify
- A destructive or out-of-pattern tool call in the pilot is flagged with context.
Area: Agent & MCP Governance
Attribute every connector and tool call alert to a person
Answer which server and tool were called, by whom, using which identity, every time an alert or intervention fires.
- Why it matters
- Without attribution, an agent action cannot be investigated or tied to accountability.
- How to verify
- Every pilot tool call alert shows the tool used, the surface, the user identity, and the result.
Area: Agent & MCP Governance
Provide targeted containment for a single connector or tool.
Disable or revoke one connector, tool, plugin, or integration for a user or group without switching off the whole AI tool.
- Why it matters
- When one connector misbehaves, switching off the whole AI tool punishes everyone.
- How to verify
- One connector is disabled for one pilot group while the AI tool keeps working.
Area: Agent & MCP Governance
Discover the MCP servers and connectors employees attach to their AI clients
Inventory local and remote MCP servers reached from desktop, IDE and CLI AI tools with owner, scope and exposure.
- Why it matters
- MCP-capable clients now ship inside IDEs, terminals and desktop apps, and each connector is a new path to corporate data.
- How to verify
- Local and remote MCP servers used by pilot users appear with client, owner, scope and exposure.
Area: Agent & MCP Governance
Map the actions available via each connector.
Show, per connector/MCP server, what actions are available and which are currently enabled.
- Why it matters
- Approving a connector without knowing which actions it exposes and which are enabled leaves the scope of available functionality unclear.
- How to verify
- For three connectors you name, the console lists the actions each exposes and shows which are currently enabled.
Area: Agent & MCP Governance
Support local and remote MCP gateway placement for employee AI clients
Support applicable Windows, macOS and Linux patterns, allow endpoint-integrated or remote placement, and define traffic coverage for each.
- Why it matters
- Different MCP clients need different gateway placements to be covered.
- How to verify
- The vendor shows local and remote MCP gateway placement and documents what each covers.
Area: Agent & MCP Governance
Detect indirect prompt injection in content agents read
Identify malicious instructions from the sources that AI systems are able to read from. Name the originating connector or source, respond before the agent acts where configured, and demonstrate tested coverage and known gaps.
- Why it matters
- A poisoned tool response can turn a trusted agent into an attacker's tool while the user's prompt looks harmless.
- How to verify
- Injected instructions in content returned to pilot users' agents are detected and attributed to their source.
Area: Agent & MCP Governance