Writing on Agent Identity, Policy & Audit

As AI agents move from answering questions to taking actions, explainability stops being enough. Organizations need to answer a different question: did the agent actually have the authority to act?

Every AGF specification — delegation tokens, chains, trust zones, revocation, audit, and protocol adapters for MCP, A2A, and HTTP — is now published under Apache 2.0 at github.com/agent-governance-foundation/agf-standards, with an open RFC process and a conformance path for independent implementations.

MCP and A2A give agents standard tool-calling and delegation protocols. Plenty of agents still just call a plain REST API — internal microservices, third-party SaaS, GraphQL endpoints. The AGF HTTP Gateway fronts those, too, without requiring the downstream API to change.

MCP, A2A, and REST gateways all work by fronting a downstream server. A browser-automation agent has no downstream server — it drives a local browser directly. Here's how AGF governs that case instead.

The Agent2Agent protocol standardizes how one agent discovers and delegates work to another. It doesn't standardize whether that delegation should be allowed. Here's how the AGF A2A Gateway closes that gap.

The Model Context Protocol standardizes how agents discover and call tools. It doesn't standardize whether they should be allowed to. Here's how the AGF MCP Gateway closes that gap — register your MCP server, and every tool call gets a real authorization decision before it executes.

'What if the AI does something bad' is too vague to build a security program around. Here are the four attack patterns that actually show up in agent deployments, and the controls that address each one.

Auditors don't ask about your model's benchmark scores. They ask who did what, when, under what authority, and whether you can prove it. Here's how AGF's audit artifacts map to the three frameworks compliance teams are actually being asked about.

Most 'AI security' conversations are still about model safety — jailbreaks, hallucinations, prompt injection. That's not the same problem as securing what an agent is authorized to do once it's deployed. Here's the distinction, and the control surface that matters.

Oktane 2026 is billing itself as the AI security event of the year, with a simple tagline: agents change everything. We agree — and think the industry conversation is about to split into two layers: who an agent is, and what it's allowed to do.

AutoGen's function_map has no authorization concept — any registered function is one tool call away from execution. Here's how to gate it with the AGF Python SDK, no framework-specific adapter required.

CrewAI's Agent/Task/Crew model has no built-in concept of policy enforcement — every tool call an agent makes is implicitly trusted. Here's how to gate CrewAI tool calls with AGF in a few lines.

The Python SDK for the AGF Authorization Service is now published on PyPI. One package, three ways to call it: a synchronous facade, an async client, and framework adapters for LangChain and CrewAI.

Multi-agent systems inherit a centuries-old problem: how do you ensure that what the subordinate does is what the principal actually authorized? This isn't a technical problem — it's a governance one.

LangChain makes it easy to build capable agents. But capability without authorization is a liability. Here's how to add policy enforcement to your LangChain agents in under 10 minutes.

Why there's no single revocation state, and why that's okay.

Everyone is talking about AI governance. But agent governance is a specific discipline within that — one most organizations aren't ready for yet. Here's what it actually means and why it's different.

Why agent governance needs a new model for revocation.

Most organizations deploying AI agents today cannot answer a simple question: what did the agent do, and why? This post explains why that's the case and what a real audit trail looks like.

The API keys and service accounts we use for human-facing systems don't translate cleanly to agent systems. Here's why, and what we need instead.