Your IAM does not see what an agent decided to do, and each system keeps only its own fragment — so afterwards you cannot prove what happened. AgentGov answers each request against approved policy before the action runs, and seals the answer into a tamper-evident ledger you can hand to an auditor.
It is a cooperative enforcement point, not a network interception layer: an agent is governed because it asks. One call, before it acts — that is the whole integration, and an agent that never asks is a gap you can see rather than one you assume away. Route a tool through the AgentGov gateway instead of straight to the upstream, and a refused call is never forwarded at all.
Built for governance on
Governance teams already own IAM and ERP role design. Neither was built for the agents that are now making the calls.
Your identity platform was designed for people who log in. AI agents operate through service accounts, shared API keys, and machine tokens — invisible to the controls you already own. When an agent does something risky, nobody gets a review.
Workday doesn't know what Salesforce granted. ServiceNow doesn't know what the agent can do in either. Each system holds a fragment and none holds the record — so when an auditor asks what an agent did last quarter, nobody can answer.
Ship in weeks, not quarters. Unmapped actions are denied by default — fail-closed, not fail-open.
Register the agent, name the human accountable for it, and grant it duties. Map each action it can take to the duty that authorises it and the data scope it may touch. Nothing is governed until it is declared — unmapped actions are denied.
Your agent calls the MCP `check_action` tool before sensitive operations. AgentGov resolves the agent's duties, evaluates your runtime policies, and returns allow or deny — then seals that decision into a tamper-evident ledger.
Every decision is committed to a hash-chained audit log. Export evidence packages mapped to EU AI Act articles, run attestation campaigns, and certify agent access on a schedule.
Shipped today. No vaporware, no “coming soon” boxes.
Every agent carries the human accountable for it. When an auditor asks who authorized this, the answer is a named person, not a service account — and it is in the record, not a spreadsheet.
A denial records whether the policy refused it, the agent lacked the duty, or the action was never mapped — and only a policy-caused refusal is credited as an enforcement. An auditor asking why gets an answer, not a policy id that permitted the action.
Agents call `check_action` before sensitive operations. Unmapped actions deny by default. The application uses OAuth 2.1 bearer tokens; the current reference production edge additionally requires a client certificate.
Every governance decision is committed to a PostgreSQL-trigger-backed hash chain by a BEFORE INSERT trigger. Tamper-evident by construction, and exportable for a third party to re-verify offline without AgentGov running.
WHO (identity principals), WHAT (duty roles from a hierarchical role DAG), WHICH (data scopes from job role + security profile). The same model compliance teams already speak.
Ship as a LangChain tool wrapper, a LangGraph middleware, an OpenAI Agents SDK run hook or a Claude Agent SDK pre-tool hook — no policy DSL to learn. Existing agents gain governance in a dozen lines; any agent routed through an adapter is governed before its tool call runs.
Wrap one tool with check_action and every call is checked against your org’s role DAG and runtime policies before it executes, and the decision is sealed into a tamper-evident ledger. Adapters ship for LangChain, LangGraph, the OpenAI Agents SDK and the Claude Agent SDK, with CrewAI in contrib.
agents/invoice_bot.py
from langchain_core.tools import tool from agentgov_langchain import AgentGovClient, AgentGovTool client = AgentGovClient( # A registered agent's UUID. Not a slug: the server parses this as a UUID # and refuses anything else. agent_id="8d2b1f60-3c4e-4a91-9f77-2b6d0e5a1c48", mcp_url="https://agentgov.example.com/mcp", client_id="mcp_your_client_id", client_secret="your_client_secret", # pragma: allowlist secret) @tooldef approve_payment(invoice_id: str, amount: float) -> str: """Approve an outgoing invoice payment.""" return f"approved {invoice_id} for {amount}" # The check runs first. The tool body runs only if the engine allows it, and a# refusal raises AgentGovDeniedError — carrying the reason, and in the ledger# unless denied.undecided says the check itself failed and decided nothing.guarded = AgentGovTool.wrap( approve_payment, client, action="finance.payment.approve",)decision.json
{ "allowed": false, "decision": "deny", "recommendation": "Action denied by runtime policy.", "violations": [], "event_id": "9f2c1e40-...-8b17", "approval_id": null, "retry_after_seconds": null, "undecided": false}AgentGov’s hash-chained decision ledger, policy enforcement, and attestation campaigns generate the artefacts the EU AI Act’s high-risk obligations call for — assembled for a reporting period, listing the controls with no evidence in it rather than leaving the gaps out.
Those obligations bind deployers from 2 December 2027, not August 2026 — the Digital Omnibus deferred them. We say so because the reason to start now is the other one: Article 26(6) wants at least six months of retained logs, and log history cannot be back-filled.
Art. 9
Risk management
Art. 12
Recordkeeping
Art. 13
Transparency
Art. 14
Human oversight
Art. 17
Quality management
Art. 26
Deployer obligations
30-minute demo. Watch one action permitted and the next refused by policy, then re-verify the sealed ledger and read the evidence pack against the EU AI Act articles it covers — gaps included.