Govern — agents & MCP at runtime

Govern is the runtime half of Unveilr: register agents as owned software artifacts, mint scoped credentials, and enforce policy on every MCP / tool call through the Agent Gateway. Authoring-time risk stays in Guard; Prove records what happened in Prove.

The instructions that steer an agent — its prompts — are governed with the same discipline: see Prompt SDLC for content-hashed prompt versions, drift-quarantine, and binding an agent to an approved prompt version.

Authority is bound to the agent's declared purpose, not just its tool allowlist — a forbidden tool or an out-of-scope data class is denied even when the allowlist admits it. See AgentScope.

To reduce an agent's standing authority rather than only allow or deny it, a policy can decide scoped_token — the broker mints a short-lived credential scoped to the exact action and resource. See Credential mediation.

Why it matters

An AI-BOM tells you an agent exists. Govern answers:

• Who owns it?
• What tools is it allowed to call?
• Is this live call still admissible — or did the tool definition drift, the schema break, or policy deny it?
• Can we prove what was allowed, held for approval, or blocked?

Without a gate, “inventory + PR scan” still leaves production agents free to act.

Agent deployment gate

An agent may act only once it has a registered identity: a named human owner and an approved tool scope. Unregistered agents have no credential and calls fail closed.

Enterprise default: your IdP (Okta XAA / Entra Agent ID / OIDC) issues the JWT; Unveilr binds that subject and enforces scopes + policy. Lab fallback: approval mints a scoped uvt_ token (shown once).

Stage	What happens
Discover	Scans surface agents as AI-BOM assets; unregistered agents raise agent_unregistered (high) — fails PR in enforce
Register	POST /v1/agent-identities (owner required)
Configure IdP	Settings → Identity Providers — issuer, JWKS (Discover), audience, subject claim
Approve	Bind IdP & approve (no secret) — or lab-mint uvt_ (shown once); evidence-logged
Revoke	Instant kill switch — IdP JWT / uvt_ rejected immediately
Scope	allowedTools enforced on every Gateway / govern/check call

Full IdP runbook: Enterprise agent identity.

Screenshot to capture — Agents

Console path: /agents (list) and /agents/[id] (detail)
Capture: agent with owner, approval status, allowed tool scope, and link to related findings / sessions.
Story it tells: “Agents are owned software — not anonymous runtime.”

The Agent Gateway

Route MCP tool calls through Unveilr instead of calling tools directly:

Agent ──▶ Unveilr Gateway  ──(allow/deny/approve/step-up/sanitize)──▶ MCP tool

Point clients at: https://gateway/mcp/{tenant}/{server}.

Decision pipeline

Runtime controls

• Agent tool scope — out-of-scope calls denied (agent_scope), hard in every mode.
• Schema enforcement — unexpected fields rejected against approved inputSchema.
• Rug-pull quarantine — live tool definition drift → quarantine until re-approval.
• Rate limiting — per-identity sliding window; over limit → 429 (would-block in observe).
• Session anomaly baseline — high rates of blocked/flagged calls raise anomaly.
• Response sanitization — secrets/PII stripped as a safety floor even in observe.
• Policy actions — allow · deny · require-approval · step-up · redact · sanitize · rate-limit.

Monitor Mode at runtime

In observe, the Gateway records what it would have blocked (headers x-unveilr-mode: observe, x-unveilr-would-block: …) but still forwards; response sanitize and structural protections stay on. Flip servers to enforce when trusted.

Screenshot to capture — Policies & Approvals

Console paths: /policies, /approvals
Capture: an environment pack, editable policy rule, draft simulation explanation, and a pending approval queue item. Story it tells: “Runtime governance is operable by humans, not only YAML.”

The Policies workbench supports the full lifecycle: install packs, create from a template, author validated selectors/conditions, simulate unsaved drafts with the gateway engine, then enable, edit, duplicate, disable, or delete. See Runtime policies for the complete schema and rollout guide.

Screenshot to capture — Sessions & Detections

Console paths: /sessions, /detections
Capture: a session timeline with allow/deny decisions; a runtime injection or exfil detection alert.
Story it tells: “Every tool call is auditable — and attacks are visible.”

Screenshot to capture — Registry

Console path: /registry
Capture: MCP servers / tools with approval state (approved vs quarantined).
Story it tells: “Only approved tool surfaces are callable.”

Programmatic check (thin on-ramp)

Services that aren't MCP clients can ask the control plane before acting:

curl -X POST https://your-instance/v1/govern/check \
  -H "authorization: Bearer $UNVEILR_AGENT_TOKEN" -H 'content-type: application/json' \
  -d '{"tool":"create_issue","server":"github","arguments":{"title":"hi"}}'

SDKs (copy-paste adapters):

Runtime	Package
Python	pip install -e sdk/python → from unveilr import govern
LangChain	from unveilr.langchain import governed_tool
CrewAI	from unveilr.crewai import governed
LangGraph	from unveilr.langgraph import governed_callable, wrap_tools
Node	sdk/js → import { govern } from '@unveilr/sdk'

Console → Agents → On-ramp generates the same snippets for a registered identity. Customer cookbooks: Govern check and Persona playbooks → Agent. Operator afternoon path: repo docs GOVERN_ONRAMP.md / partner guide PARTNER.md.

Use this to gate custom agents, workflows, or platform hooks with the same policy and evidence model as the Gateway.

Integration experience

1. Register & approve agents in the console (or API). Prefer two people in production (register vs approve — separation of duties).
2. Click On-ramp for curl / Python / Node / MCP snippets, or point MCP config at the Gateway URL (one line change for many clients).
3. Install an env pack in the Policies workbench, or call POST /v1/policies/packs/pack-staging/install (then pack-production when promoting).
4. Start all servers in observe; review Sessions / Approvals.
5. Wire a SIEM notification channel (or GET /v1/evidence/export?since=…) so allow/deny lands in your SOC tooling.
6. Tighten scopes; flip high-value servers to enforce; revoke = kill switch.

See Integrations → Agent runtime for rollout checklist items.

Value summary

Without Govern	With Govern
Agents call MCP directly	Every call passes identity + policy + schema
No kill switch	Revoke credential → fail closed instantly
Tool defs can change silently	Rug-pull quarantine until re-approval
“We think it’s safe”	Hash-chained allow/deny/approve evidence