AGP · AGENT GOVERNANCE PLANE
You need control over what your agents do — before they do it, not after.
Meet AGP — the Agent Governance Plane. Your agents keep working at full speed. Nothing dangerous happens without your say-so.
AGP IN ACTION · FROM A REAL SESSION
That held action didn't vanish. It's waiting — for you:
You just did the most important job in agentic AI: you were the human in the loop. And this card is not a mockup — this exact order was held, approved by a human, and filled through AGP. Real broker, real money, real audit trail. The receipts are below.
ALWAYS ON · EVERY AGENT · EVERY CALL
Governance is a runtime, not a policy doc.
Every line below is one decision: identity checked, envelope checked, policy evaluated, outcome recorded.
Reads flow. Dangerous writes wait for a human. Everything is attributable — which agent, which tool, which human, which decision.
PROOF · RUN AGAINST REAL SYSTEMS
Three controls. Three receipts.
The gate you use every day — and the two emergency controls you hope you never need. All three exercised live, with real error strings to show for it.
POLICY_HOLD · HTTP 423An agent placed a real brokerage order. AGP froze it twice — at review and at placement — for explicit human approval. Then, and only then, it filled.
BEHAVIOR_PROFILE_DENIEDAn agent behaving strangely? Suspend its profile — one action in the console. We did it to a live agent mid-session: its very next call was refused, fail-closed. No restart, no redeploy, no cooperation from the agent. Blast radius capped while you investigate.
MCP -32602: unknown toolA compromised tool server? Yank it from the registry once, and for every agent and every profile at the same moment its tools simply cease to exist — indistinguishable from tools that never existed at all.
THE MODEL · SIX STAGES, ONE PIPELINE
Everything an action passes through.
The same pipeline you watched work above — stage by stage.
01 — Tool governance
A governed registry of every tool your agents can reach — each one deliberately onboarded and classified (read / write / delete). If it isn't in the registry, it doesn't exist. Yank a server and it vanishes for everyone at once.
02 — Behavior profiles
Every agent identity is bound to an envelope that decides which of those tools exist for it. Fail-closed: a new agent sees nothing until granted. Suspend the profile and its next call dies mid-session.
03 — Policies you define
You decide which actions flow, which are denied outright, and which must wait for a human — by tool, by operation type, by agent. Reads glide; irreversible writes meet judgment.
04 — Human approvals
Dangerous actions pause in-flight — HTTP 423, not a Slack ping after the fact. A human approves or denies from the console; the decision and the decider land in the record.
05 — Credential custody
Agents connect to AGP through OAuth. Provider credentials stay protected in AGP—not stored with agents—reducing exposure if an agent is compromised. AGP dynamically injects the required credentials at runtime for each tool invocation. Disconnect removes stored credentials and attempts revocation at the provider.
06 — Audit with attribution
Every allow, deny, and hold — which agent, which tool, which decision, which human. The question incident review always asks, answered from a feed on your own infrastructure.
Stand between your agents
and your systems.
curl -fsSL https://raw.githubusercontent.com/getraksha/agp/main/install.sh | sh