AI Agent Governance for Enterprise Teams

Give approved agent work an owner and a scope

Employees already use agents to read code, run commands and call internal tools. Governance starts by naming the allowed work, its owner and the point where authorization must happen. APort connects an agent passport to policy checks before supported actions execute.

Keep your identity provider, service permissions and human review. A passport describes agent authority; the connected runtime or GitHub check must enforce the decision.

Choose the control for each action

Use runtime guardrails for supported shell, file and MCP calls. Use GitHub Repository Guard to evaluate changes that reach the repository. Hosted verification produces signed decisions and organization audit; local evaluation has a different evidence scope.

• Assign a policy owner and an exception approver for each workflow.
• Record local or hosted mode and report-only or enforcement behavior.
• Retain an allowed case, a denied case and the observed runtime outcome.

Expand from one team with reviewable evidence

Start with a bounded repository and developer cohort. Review policy findings with the team before requiring checks or changing managed-device settings. Expand when legitimate work still completes and the prohibited fixture is stopped at the intended boundary.

A rollout report should identify covered tools, uncovered paths, unresolved exceptions and who may suspend access. Signed receipts help reviewers reconstruct decisions; they do not certify compliance or complete coverage.