How to govern Agent Governance Toolkit
A step-by-step guide to governing Agent Governance Toolkit with Rencore: detect with 12 policies, review with 5 reports, and remediate with 0 automations.
Governing Agent Governance Toolkit means keeping its access, configuration, and lifecycle under continuous control rather than reacting after something breaks. Rencore governs Agent Governance Toolkit with 12 pre-built policies, 5 reports, and 0 automations, so teams can detect risk, review posture, and remediate with an audit trail. The steps below turn that coverage into a repeatable routine.
Steps
-
Inventory Agent Governance Toolkit
Connect Agent Governance Toolkit and let Rencore build a continuous inventory of its resources, owners, and configuration, so governance starts from what exists rather than a stale export.
-
Detect with policies
Turn on the pre-built policies that cover Agent Governance Toolkit to surface oversharing, sprawl, and misconfiguration on the first scan, before writing a single custom rule.
-
Review by owner and severity
Use the Agent Governance Toolkit reports to review findings by owner, category, and severity, and to share them with stakeholders who do not have a seat in the platform.
-
Remediate and automate
Apply automations to fix findings at scale, route sensitive changes through approvals, and keep every action reversible and logged for the audit trail.
Recommended Agent Governance Toolkit policies
Grounded in the Rencore catalog. See the full Agent Governance Toolkit catalog on the Agent Governance Toolkit connector page.
-
Prompt injection detected in last 24h
Detects PROMPT_INJECTION_DETECTED audit events emitted by AGT in the last 24 hours.
Severity: High -
Content violation detected in last 24h
Detects CONTENT_VIOLATION audit events emitted in the last 24 hours.
Severity: High -
MCP tool poisoning detected in last 24h
Detects MCP_TOOL_POISONING audit events raised by the AGT MCP Security Gateway in the last 24 hours.
Severity: High -
Agent denial spike (5+ denies in lookback window)
Detects agents with five or more policy_decision = deny rows within the configured lookback window.
Severity: Medium -
Identity rejection in last 24h
Detects IDENTITY_REJECTED audit events in the last 24 hours.
Severity: High -
Escalation requested in last 7 days
Detects ESCALATION_REQUESTED governance events raised in the last 7 days, so reviewers can confirm each has been actioned.
Severity: Medium -
AGT policy bound to no agents
Detects AGT policies that have produced no decisions and are bound to no agents in the lookback window.
Severity: Low -
Agent observed in lookback window
Risk-probability multiplier: agents currently producing AGT events have a live blast radius.
Severity: Medium -
Agent has hit a policy guardrail
Risk-probability multiplier: agents with one or more policy_decision = deny rows operate near the guardrail, raising the likelihood that a weakness becomes an incident.
Severity: Medium -
High-volume agent (40+ events in lookback window)
Risk-probability multiplier: agents with high event throughput have a larger exposure surface, raising the likelihood that a weakness manifests.
Severity: Medium
