Your IAM doesn’t see the agents calling your ERPs. Your ERP roles don’t model toxic access combinations across Oracle, Workday, Salesforce, and ServiceNow. AgentGov does — in real time, with evidence you can hand to your auditor.
Built for governance on
Governance teams already own IAM and ERP role design. Neither was built for the agents that are now making the calls.
Your identity platform was designed for people who log in. AI agents operate through service accounts, shared API keys, and machine tokens — invisible to the controls you already own. When an agent does something risky, nobody gets a review.
Oracle doesn't know what Salesforce granted. Workday doesn't know what the agent can do in ServiceNow. Toxic duty combinations form across providers and under shared identities — and your SoD review never catches them.
Ship in weeks, not quarters. Unmapped actions are denied by default — fail-closed, not fail-open.
One-way sync from Oracle Fusion, Salesforce, Workday, and ServiceNow pulls agents, roles, duties, and data scopes into a unified graph. No changes to your source systems.
Your agent calls the MCP `check_action` tool before sensitive operations. AgentGov resolves the agent's duties, evaluates 61 cross-provider SoD rules, and returns allow, deny, or audit — in milliseconds.
Every decision is committed to a hash-chained audit log. Export evidence packages mapped to EU AI Act articles, run attestation campaigns, and certify agent access on a schedule.
Shipped today. No vaporware, no “coming soon” boxes.
Detects toxic combinations that span an agent and the human principal it acts for. If your invoice bot and Jane Doe collectively hold both sides of a segregation rule, AgentGov catches it.
Conflicts only fire when both sides overlap on a scope dimension (same business unit, legal entity, or ledger). Prevents the false positives that bury real violations.
Agents call `check_action` before sensitive operations. Unmapped actions deny by default. OAuth 2.1 bearer tokens with 15-minute TTL; mTLS at the edge in production.
Every governance decision is committed to a PostgreSQL-trigger-backed hash chain. Tamper-evident by construction. 16 event types covering lifecycle, entitlements, and agent actions.
WHO (identity principals), WHAT (duty roles from a hierarchical role DAG), WHICH (data scopes from job role + security profile). The same model compliance teams already speak.
Ship as a LangChain tool wrapper or a CrewAI decorator — no policy DSL to learn. Existing agents gain governance in a dozen lines; new agents are governed by default.
Every action you map earns a governed path. Everything unmapped is denied.
Finance · SCM · HCM
16
SoD rules
Object · System perms
15
SoD rules
HCM · Payroll · Finance
15
SoD rules
ITSM · Security · HR
15
SoD rules
Fail-closed by design: actions not mapped to a duty are denied at the MCP server.
Wrap one tool with check_actionand every call gets resolved against your org’s role DAG, SoD rules, and data scopes. Adapters ship for LangChain and CrewAI.
agents/invoice_bot.py
from agentgov import AgentGovClientfrom langchain.tools import tool client = AgentGovClient("https://mcp.your-company.com") @tooldef approve_payment(invoice_id: str, amount: float): decision = client.check_action( agent_id="invoice-bot-42", action="oracle.finance.payment.approve", context={"amount": amount, "business_unit": "EMEA_FIN"}, ) if decision.decision == "deny": raise PermissionError(decision.reason) # proceed with the approvaldecision.json
{ "decision": "deny", "reason": "SoD conflict: agent already holds CreateInvoice duty", "violations": [{ "rule_id": "SOD-FIN-001", "rule_scope": "cross_identity", "data_scope_overlap": true }], "audit_id": "01JN7H...K3Y2", "latency_ms": 4}AgentGov’s hash-chain audit log, SoD detector runs, and attestation campaigns generate the artefacts required by the EU AI Act high-risk system obligations. Export per framework, download per article.
Art. 9
Risk management
Art. 10
Data governance
Art. 12
Recordkeeping
Art. 13
Transparency
Art. 14
Human oversight
Art. 17
Quality management
30-minute demo. Walk through a live SoD violation across Oracle and Workday, then see the audit evidence exported to an EU AI Act package.