# Governance

> Deciding what an agent may reach: roles, restrictions, frozen arguments, the audit trail afterwards, and what happens when somebody leaves.

- [MCP governance: who may do what, in which app](https://elaichi.ai/blog/mcp-governance/) — MCP governance decides who connects which app, which tools each role calls, whose account a call uses, what is logged and how access ends.
- [Vendor MCP servers: why run them through Elaichi](https://elaichi.ai/blog/vendor-mcp-servers-through-elaichi/) — Vendor MCP servers bring the vendor's own tools. Through Elaichi they also get one address, per-person sign-in, tool rules and one audit log.
- [AI agents with employee permissions, no shared bot](https://elaichi.ai/blog/ai-agents-employee-permissions/) — How to run AI agents with employee permissions instead of one shared service account, and the cases where a named service identity is still correct.
- [Approved AI tools per team, set by role](https://elaichi.ai/blog/approved-ai-tools-per-team/) — Approved AI tools per team is two jobs: restrictions bound to a role for enforcement, and templates shared to a team for curation.
- [IT admin controls for MCP connectors, compared](https://elaichi.ai/blog/it-admin-controls-mcp-connectors/) — What the IT admin controls for MCP connectors cover in Claude, ChatGPT and Cursor, and the three gaps none of those consoles closes.
- [Scheduled AI agent tasks, governed in advance](https://elaichi.ai/blog/scheduled-ai-agent-tasks-safely/) — Scheduled AI agent tasks run with nobody present to approve, so the controls that count are set first: role restrictions, frozen arguments, a narrowed grant.
- [EU data residency for AI agents, leg by leg](https://elaichi.ai/blog/eu-data-residency-ai-agents/) — EU data residency for AI agents spans three legs: the app, the control plane and the model. Elaichi's eu region pins the data store and tool calls to the EU.
- [Human approval for AI agent actions: the layers](https://elaichi.ai/blog/human-approval-for-ai-agent-actions/) — Human approval for AI agent actions comes in layers: a prompt for the person asking, then the role rules, frozen values and requests an admin decides.
- [MCP security review checklist: ten questions](https://elaichi.ai/blog/mcp-security-review-checklist/) — An MCP security review checklist: ten questions to ask before approving an MCP server or gateway, what a good answer looks like, and Elaichi's answers.
- [MCP security risks and how to reduce them](https://elaichi.ai/blog/mcp-security-risks/) — The MCP security risks a company faces, from prompt injection to keys in local configs, with an example and a fix for each, and who owns the fix.
- [How to roll out Claude and ChatGPT to employees](https://elaichi.ai/blog/roll-out-claude-and-chatgpt-to-employees/) — Roll out Claude and ChatGPT to employees in order: approve apps, connect them once, build team toolboxes, map roles, pilot, onboard and offboard.
- [Least privilege for AI agents without breakage](https://elaichi.ai/blog/least-privilege-tool-calls-without-breaking-automation/) — Least privilege for AI agents starts from what your pilot actually called: narrow to that recorded set, then confirm the rule landed before you trust it.
- [SOC 2 evidence for AI agents: CC6 and CC7](https://elaichi.ai/blog/soc2-evidence-ai-agents-cc-controls/) — SOC 2 evidence for AI agents maps to CC6.1, CC6.2, CC6.3 and CC7.2: who can reach what, how access starts and ends, and a log of each executed tool call.
- [Why blocks match tool names but allows don't](https://elaichi.ai/blog/block-matches-name-allow-matches-operation/) — In Elaichi, blocks match tool names or the operation behind them, while allows match the operation only, so a renamed tool can never widen a role's reach.
- [Lock AI agent tool arguments, like a wire's payee](https://elaichi.ai/blog/frozen-parameters-wire-transfer-receiver/) — Lock AI agent tool arguments with frozen parameters: Elaichi removes the field from the model's schema and writes your value over whatever the call sends.
- [Designing roles for AI agents: one role each](https://elaichi.ai/blog/designing-roles-for-ai-agents/) — Design roles for AI agents as one complete job per person: Elaichi gives each member exactly one role and leaves which tools they reach to restrictions.
- [AI agents and PHI: four questions for your BAA](https://elaichi.ai/blog/hipaa-ai-agents-baa-reviewer-questions/) — AI agents and PHI raise four BAA questions, all about access: minimum necessary, audit controls, workforce clearance and what happens when someone leaves.
- [What an AI agent audit log must capture](https://elaichi.ai/blog/what-an-ai-audit-log-must-capture/) — An AI agent audit log must capture who acted, which client called, which account was reached, what was tried and how it ended. Argument contents stay out.
- [Is Composio secure enough for enterprise use?](https://elaichi.ai/blog/is-composio-secure-enough-for-enterprise-use/) — The answer to "is Composio secure enough for enterprise use" sits in architecture more than controls: its own pages list SSO, role permissions and call logs.
- [Restrict one AI tool or the whole app? Six cases](https://elaichi.ai/blog/per-tool-vs-per-app-restrictions/) — Restrict one AI tool when a role needs part of an app, and block the whole app when it needs none of it. Six cases, and what new tools do to each rule.
- [Offboarding AI access, contractors included](https://elaichi.ai/blog/offboarding-when-the-agent-holds-access/) — Offboarding AI access in Elaichi takes effect on the next call. Here is what the removal preflight checks, and the order that works.