➜ five levers an admin actually holds — control, money, safety, accountability, identity
Governance for AI agents.
Not a policy PDF.
Before a team runs agents against real data, someone signing the cheque needs a straight answer to five questions. What may it use, what can it spend, what needs a second signature, what did it actually do, and who is really signed in. Each one below is a real setting, enforced at the moment it matters, not a claim on a slide.
- org roles
- 6
- rule available
- 2-signer
- audit events kept
- 500
- audit streaming
- SIEM
01Control
What the team may reach for
set once, checked on every call.
An admin restricts providers and models (down to a locked default), which MCP servers a run may connect to, and which tools an agent may call at all - the exact allow/deny shape a gateway key already uses. The rules live in one dependency-free module evaluated identically in the browser and on the server, so what a tab shows before a run is the rule the server enforces after.
stopsAn agent quietly gaining a model, an MCP server, or a tool nobody on the team approved.
a mock of the real console (Settings) — not live data
02Money
What the team may spend
a cap, not an invoice surprise.
An org sets one monthly hosted-spend cap and, optionally, a tighter per-member default - the same numbers the Team usage dashboard already shows, never re-derived twice. Org-wide and per-member request/token rate limits sit alongside it, and a daily spend history (kept as it happens, not recomputed on read) drives a real forecast with spike detection, so a runaway loop shows up as a trend line before it shows up on a bill.
stopsA runaway agent loop, a leaked key, or one enthusiastic teammate turning into a five-figure bill nobody saw coming.
a mock of the real console (Settings) — not live data
03Safety
What a run may do alone
and what needs a second signature.
A destructive tool call can pause for the account’s own approval, or be routed to any admin - your choice. Turn on the two-person rule and an org’s highest-impact actions (transferring ownership, deleting the team, clearing its budget cap, removing a member) file a proposal a DIFFERENT admin must approve before anything executes. Guardrails redact PII and screen for prompt injection on the way in and out, at the gateway and at run start, not as a client-side suggestion.
stopsOne compromised or careless account taking an irreversible action alone, or a prompt-injected run quietly exfiltrating data.
a mock of the real console (Settings) — not live data
04Accountability
What actually happened
kept, signed, and forwardable.
Every governance change, spend event, run, and guardrail trigger lands in a per-account and per-org audit ring - the same one billing already writes to - kept for 400 days. Turn on streaming and every entry is also delivered, HMAC-signed, to a webhook URL you own, with retry and backoff so a slow SIEM ingestion endpoint never drops an event silently. Run provenance (who ran it, through which door - a tab, a schedule, or the gateway - on which model, for how much) is the same record an admin reads in Settings, an export bundle, and your SIEM.
stopsAn incident review with no record of who ran what, when, or through which door.
a mock of the real console (Settings) — not live data
05Identity
Who is actually signed in
and for how long.
An owner can require a specific sign-in provider or email domain before the org will accept a session at all. Six roles - owner, admin, member, and three lateral roles (billing_admin, policy_admin, viewer) - hand out exactly the slice of admin power a title implies, instead of an all-or-nothing toggle. A contractor gets a time-bound membership that expires itself and removes their access with no standing ticket, and the same six-role matrix maps cleanly onto group-based provisioning, so wiring it to your IdP later is a connector, not a redesign.
stopsA departing contractor’s access outliving their contract, or a credential nobody can trace back to a real identity.
a mock of the real console (Settings) — not live data
06See it enforced
Governance is not a
separate promise from the product.
control · money · safety · accountability · identity