Know what your AI agents are allowed to touch.
An agent reads whatever it is pointed at and hands the result to tools it was told about. In a regulated organization that is your integration code, your nightly exports and your configuration.
What happens in an ordinary week
A coding assistant asks a tool behind the RedactWall guard to read a file drop
The tool is approved first, and what comes back is checked before the model reads it.
An agent reaches through RedactWall for a tool nobody sanctioned
The call is refused, and the attempt is on the record.
A developer wires up a new tool on an enrolled workstation on a Friday
It shows up as a finding, because you never approved it.
The IT director reviews reported agent setup across enrolled workstations
Workstations that were actually checked are separated from ones only assumed clean.
What covers it
The coverage table states what each surface does, and Disclosures how far each one is proven today.
Govern the agents. Keep the speed.
These workflows describe the broader product. The proposed first pilot covers ChatGPT text in managed Chrome and a separately verified Anthropic gateway path.
- Pilot starts with one governed path
- Coverage follows the path you deploy
- Evidence states what it does not prove