AI agent actions with approvals and audit trail

What problem are you actually buying for?

You are buying a place to put the rules, so that AI agent actions with approvals and audit trail behind them happen as a specific person, within limits somebody set. An agent acting in Salesforce, Zendesk or Stripe should leave a record. That is the job. Everything else on these product pages is coverage.

The situation that sends people looking is familiar. Someone on the revenue team has connected Claude to HubSpot with their own credential. Someone in finance has a Zapier account with a long-lived token in it. A security reviewer has asked who approved any of it. You cannot answer from the AI clients, because each keeps its own configuration and its own idea of what approval means.

So this compares five platforms on four questions: who approves, what is logged, how per-person access works, and which AI clients an admin can actually distribute the thing to. The platforms are Zapier MCP, Composio, Arcade, Merge Agent Handler and Elaichi.

One warning about the first question. For most of these, the per-call approval prompt belongs to the AI client, not to the layer in the middle. Where that is true, it is stated plainly below rather than counted as a feature.

A note on sourcing. Every claim below is attributed to a specific vendor page, checked on the date given next to it. None of these claims have been independently re-tested against a live account by a third party. This is a reading of what each vendor states about its own product, not a penetration test or a compliance audit. Vendor documentation changes faster than comparison pages do, so treat the dates as "accurate as of" rather than "accurate today". Confirm anything load-bearing directly with the vendor before you build a control around it. That means the approval flow, the retention window and the data residency. Two things this comparison does not cover at all: added latency from routing calls through a middle layer, and compliance certifications (SOC 2, HIPAA, FedRAMP). None of the five vendor pages reviewed here state certification status plainly enough to quote. If that is a requirement for you, ask each vendor for its trust center or audit report directly rather than relying on a marketing page.

Here are the five side by side, before the detail.

Who approves ai agent actions with approvals and audit trail in place?

Approval sits in one of three places: on the platform's own consent screen before the connection exists, in the AI client at call time, or in a workflow the platform runs. Knowing which one a vendor means is the difference between a control and a screenshot.

Elaichi. Over MCP (Model Context Protocol, the open standard an AI client uses to call tools), the OAuth grant is the approval. A person connects their client once and picks what it may do on Elaichi's consent screen. That choice governs every later call. Elaichi re-checks the grant's scopes on the server for every call, including names the client was never shown. There is no per-call approval step over MCP: the in-app approval card, remembered choices and the organization's auto-write setting play no part there. A per-call confirmation a person sees in Claude or ChatGPT is that client's own prompt. Inside the Elaichi Agent, which comes with the Black plan, approval works differently. A write stops at a card with Deny, Always allow and Allow once, a delete asks every time, and reads need no card. Workflows on Black add an approve step. It asks named people or teams in the console, in Slack with Approve and Reject buttons, or by email.

Zapier MCP. Clients on Zapier's supported list connect through OAuth from inside the client. Zapier says the person does not manage a credential: the MCP client stores the OAuth token and refreshes it (Zapier, how connections work, checked October 2026). Zapier's security page describes app and action restrictions set at the Zapier account level and enforced automatically, plus the permissions inside the apps themselves (Zapier, MCP security, checked October 2026). A per-call confirmation is the client's.

Composio. Composio's Enterprise page says a team sets the tools and connected accounts each session can use. It says Composio enforces the team's access policies when agents act, for example allowing email reads and drafts while keeping deletes disabled (Composio Enterprise, checked November 2026). Its MCP Gateway page adds that members can request access to tools blocked for them, and admins approve or deny those requests centrally (Composio MCP Gateway, checked November 2026). That is an access request queue, which is a different thing from a per-call gate. A queue governs who gets a standing grant. A gate governs whether this one call runs right now.

Arcade. Arcade's homepage says it supports pre- and post-tool-call hooks that let a team add custom policies without forking the runtime (Arcade, checked November 2026). The cost is that someone on your team has to write and maintain that hook, with no default behavior if they don't.

Merge Agent Handler. Merge's FAQ says IT and security teams get policy guardrails and DLP on every tool call (Merge Agent Handler, checked November 2026). Merge's page does not describe a named person pressing approve. Confirm it with Merge directly if your requirement is specifically a human-in-the-loop approval screen. A longer read of how Arcade, Merge and Composio differ for internal use covers sign-in and hosting alongside this.

The practical read: if your requirement is that a named human presses approve before a specific action, ask each vendor where that human sees the request. Ask for a screenshot of it, not a description of it. The answer is rarely the middle layer. Human approval for AI agent actions works through what a real approval step has to do.

What is logged: metadata, payloads and where the records go

Audit trails differ on three things a reviewer cares about: what fields each record holds, how long they are kept, and whether they leave the vendor's dashboard.

Elaichi writes one entry for each connected-tool call that reaches execution (a call refused earlier writes none). The row records the acting person, the toolbox, the tool's advertised and catalog names, the connector, and the connection the call reached. It also records the tool's classification, whether approval was required and how it was given, and whether arguments were edited. It records the surface too (console, API, MCP or the Agent), with the MCP client's id when the surface is MCP, plus the outcome and what the call touched. It does not record argument names or an argument count. It does record the value of the one URL path argument that names the object, as the target id. Reads get a plainer record. For a list or search call, that is the resource type and how many items came back, nothing about the items. A target never keeps a title for a person's record or a message, and an email address is never recorded as an id or a title. Separately, Elaichi scrubs secret-shaped values from tool results before they reach the client. That is a pattern-based backstop rather than a boundary. It catches values that look like a key or a token, not values that are sensitive for other reasons.

Elaichi keeps 90 days of audit history. For longer, an organization forwards events to its own log service. Logging destinations come with the Black plan, and Datadog is the destination that delivers. The Splunk HEC and Microsoft Sentinel forwarders answer with a not-implemented error as of this writing, a real gap if either is your team's existing SIEM. One honest limit: a call refused at the MCP scope check writes no audit entry, because that refusal happens before any executor runs. A tools list, a search, and a scope refusal are not audit rows. If your reviewer's question is "show me every refused attempt," the current log does not answer it for scope-level refusals.

Composio states that tool-call payloads are not stored. It says audit records hold metadata rather than payloads. It says the retention window is configurable from 7 days to 1 year (Composio MCP Gateway, checked November 2026). Its Enterprise page says a team can trace tool calls to the user, connected account, action and outcome (Composio Enterprise, checked November 2026). If your policy is that no customer data may sit in a third party's log store, that is the row to point at. Scan the wider field of platforms with comparable governance and logs before you settle.

Arcade says each action leaves one record naming the agent, the user and the system, streamed to your SIEM (Arcade, checked November 2026). What else that record holds is a question to put to Arcade. Arcade's homepage describes audit logs as coming out of the box while its pricing page lists audit logs under Enterprise (Arcade pricing, checked November 2026). Those two pages disagree on which tier gets the feature. Ask which applies to the plan you would actually buy before you assume it's included.

Merge Agent Handler describes a searchable audit trail and says audit logs are available on all plans (Merge Agent Handler, checked November 2026). The public page does not specify field-level schema or a retention window. Both are reasonable questions to put to sales before signing.

Zapier MCP shows activity logs of tool calls per user in the History tab of the MCP dashboard. Superadmins can review those logs for any user in the account, and MCP events also appear in the account's overall audit log (Zapier, MCP security, checked October 2026). Ask Zapier for its retention window if your compliance requirement specifies one.

For what a record has to hold before it answers a reviewer's question, what an AI agent audit log must capture goes field by field.

Per-person access: whose account does the call run as?

The blast radius of an AI agent is the credential behind it. A shared service account means every employee's agent reaches everything that account reaches. A single compromised agent session reaches all of it too.

Elaichi ties identity to the OAuth grant. Each person connects their client once and approves their own grant. Every call made with that grant's tokens acts as the person who approved it, in the organization they picked. Permissions are looked up on each request rather than stored in the token, so a role change applies before the token expires. Each member's grant is their own, listed and disconnected under Settings, then Connected apps.

Where the app on the other end should see the individual, the tools must run on that person's own connections. That means their All tools toolbox, a toolbox built on their own connections, or a template they stamp with their own connection for each connector. A toolbox shared with a team runs each entry on the connection pinned into it, under the authority of whoever pinned it, not on the caller's own account. A single shared toolbox cannot give each person their own identity in the app; per-person stamping can.

There is a middle path. A toolbox entry's locked-in values, which an AI client cannot change at call time, can hold a per-person placeholder such as the caller's email or their employee ID. Elaichi fills it in for whoever makes the call. One shared connection can then be pointed at each caller's own records. When the caller has no value for that placeholder, the call is refused before anything reaches the app rather than running unscoped.

On top of identity, Elaichi has restrictions. A restriction targets a role or one member, never a team and never the whole organization. Block rules and allow rules merge within each layer, and a block always beats an allow. A restriction change takes effect about two minutes. Some changes are faster. In Elaichi, removing or suspending a member revokes every live grant in the same transaction as the membership change. Revoking a share and disconnecting an account are effective on the next call too. When someone leaves, suspension is the lever that bites first: it does not wait for a restriction to propagate.

Zapier MCP runs tool calls on the person's existing Zapier app connections. Its security page says users are limited to app connections they own or that are shared across the account (Zapier, MCP security, checked October 2026). Zapier's rollout guidance lets administrators grant MCP access by workspace membership, with each member signing in to Zapier themselves (Zapier, rollout overview, checked October 2026). The path to watch is the connection token. Zapier documents it for clients that are not on its supported list and for a person's own Python or TypeScript code. Zapier describes a connection token as long-lived and bound to a single server. It says anyone holding it can run that server's tools and read the data they return. It advises giving each user their own server and token rather than sharing one (Zapier, how connections work, checked October 2026). That advisory is itself a signal: a long-lived, bearer-style token shared between people is the exact failure mode this whole category exists to prevent.

Arcade says agents act on behalf of the authenticated user, never through broad service accounts. It says every action runs at the intersection of what the user can do and what the agent is scoped to do (Arcade, checked November 2026). That intersection model, agent scope AND user permission rather than either alone, is a stronger default than a platform that only checks one side.

Composio says its platform supports per-user connected accounts for agents, backend jobs and application-owned tools (Composio, checked November 2026). Its pricing page lists shared connection tool calls, where other users reuse one connected account through access control, as a metered add-on (Composio pricing, checked November 2026). Both shapes exist side by side in the product. The decision is yours to make explicitly rather than one the platform makes for you by default.

Merge Agent Handler lists SCIM-based provisioning for IT and security teams (Merge Agent Handler, checked November 2026). Provisioning and per-call identity are different layers. SCIM controls who has an account and what group they're in, not which credential a given tool call runs under, and where provisioning stops covers the seam.

Client coverage: can an admin actually distribute this?

This is the row most comparisons skip, and it is the one that decides whether a rollout finishes. A middle layer nobody can add to the tools people already use is a middle layer nobody uses.

Elaichi serves MCP at one address, https://api.elaichi.ai/mcp, the same string for every organization. Which organization, person and tools a client reaches comes from the OAuth grant behind the token, not the URL. There is no per-user, per-team or per-client MCP address to create, list or revoke. Each person still connects their client once and approves their own grant.

The clients: Claude, ChatGPT, Cursor, Microsoft Copilot, any MCP client, and the Elaichi Agent inside the app. Elaichi's authorization server is written with Claude, ChatGPT and Cursor in mind. Its code names Claude Desktop, claude.ai connectors and Cursor as the clients it serves. The product team confirmed on 2026-10-21 that Microsoft Copilot reaches Elaichi through a Copilot Studio agent. That agent adds the MCP endpoint as a tool with OAuth set to Dynamic discovery. Clients register themselves through OAuth dynamic client registration, so nobody has a client ID, secret or header to paste, and no JSON config file lands on a laptop. Elaichi keeps no list of approved clients: anything that supports dynamic client registration, PKCE with S256 and a browser sign-in can connect.

On the admin side, the distribution step belongs to each client's own console. On Claude Team and Enterprise, an Owner or Primary Owner adds a custom connector from Organization settings, then Connectors. Members then find it under Customize, then Connectors, and click Connect (Anthropic, custom connectors, checked October 2026). On ChatGPT Business and Enterprise, only admins and owners create and publish custom apps from Workspace settings, then Apps (OpenAI, connecting custom MCP servers, checked October 2026). In Cursor, Team admins distribute shared MCP servers under Dashboard, then Plugins and MCPs (Cursor, MCP docs, checked October 2026). Connecting Cursor for a whole team covers the choice between one endpoint and per-developer setup.

Arcade documents seven clients connecting to an Arcade MCP Gateway over Streamable HTTP: ChatGPT, Cursor, Claude Desktop, Claude Code, VS Code, GitHub Copilot and Copilot Studio (Arcade MCP clients, checked November 2026). Each gateway sits at its own URL. That is more client coverage than Elaichi's confirmed list, but with a per-gateway URL to manage rather than one fixed address.

Composio publishes Composio Connect as an MCP server at https://connect.composio.dev/mcp (Composio Connect, checked November 2026). Its MCP Gateway gives each team its own endpoint, one URL per team, scoped to that team's permitted tools (Composio MCP Gateway, checked November 2026). Per-team URLs are a real design choice with a real cost: more things to distribute and keep current as teams are added or restructured. One endpoint or per team works through the trade-off.

Zapier MCP uses one endpoint, https://mcp.zapier.com/api/v1/connect, with clients on Zapier's supported list connecting over OAuth (Zapier, how connections work, checked October 2026). Its rollout has two parts: the admin's action in the MCP client, and each member's own sign-in to Zapier (Zapier, rollout overview, checked October 2026).

Merge Agent Handler is installed as a remote MCP server, with user-created Tool Packs (Merge Agent Handler, checked November 2026). Merge's public page does not list a specific set of supported AI clients the way Arcade's and Elaichi's documentation does. If client compatibility is a hard requirement, get that list from sales before evaluating further.

Two paths to coverage: authored connectors and native MCP servers

Coverage comes from two different architectures, and the difference decides who fixes a broken tool.

Elaichi authors and runs most connectors in its catalog itself. The rest are native MCP connectors: the vendor builds and runs its own MCP server, and Elaichi handles sign-in, access and audit in front of it. For a native MCP connector, Elaichi does not write or maintain the tools. Reports about them go to the vendor's support contact, shown on the connector's page. Both kinds come through the same address and the same search and run tools, with the same restrictions, scopes and audit log. A team on Gold or Black can also add its own remote MCP server as a connector, under the same rules, if an Org Owner or Org Admin creates it. Why run vendor MCP servers through Elaichi covers what that buys and what it does not.

That split is the question to put to every vendor. When a tool breaks, who fixes it, and on whose schedule? A platform that wrote every connector owns every bug. A wide catalog of self-authored tools can also mean a wide surface of self-authored bugs. A control plane that governs vendor servers owns the governance and the vendor owns the tools. Coverage can grow fast, but a broken tool is someone else's ticket queue. Neither is better in the abstract. They fail differently, and which failure mode you'd rather deal with is a real decision, not a tiebreaker.

On counts: Zapier's help article says Zapier MCP gives an AI access to 9,000 or more apps and 40,000 or more actions (what is Zapier MCP, checked October 2026). The same article says Zapier handles app connections, credentials and rate limits. Its security page says the tools are owned and controlled by Zapier rather than coming from third-party sources (MCP security, checked October 2026). Arcade lists 8,000 or more permission-aware tools plus custom MCP you build or bring (Arcade, checked November 2026). Composio's counts vary by page. Its Connect docs say 1,000 or more apps, its docs home says 1,700 or more, and its Enterprise page counts 1,500 or more managed app integrations. Quote the number from the page you link rather than averaging them (Composio Connect, Composio docs and Composio Enterprise, checked November 2026). Elaichi's catalog holds 650+ connectors. Raw tool count is a weak proxy for fit: a 40,000-action catalog you never use is worth less than 50 connectors that cover the apps your team actually runs AI agents against.

Where each one wins

Zapier MCP wins on breadth and on teams already running Zapier. If your existing app connections and Zaps are the asset, MCP reuses them rather than asking you to re-authenticate every app a second time. The accounting is familiar: each successful tool call uses two tasks at a fixed rate, and failed calls use none (Zapier usage, checked October 2026). The trade-off is the one noted above. Clients on Zapier's supported list sign in over OAuth with no credential for the person to manage. A client off that list, or a team's own code, uses a connection token instead. Zapier itself flags a shared, long-lived token as a risk to manage rather than a default to accept (how connections work, checked October 2026).

Composio wins where a team is building its own agent and wants policy and identity managed for it rather than owning that code themselves. Its homepage speaks to developers building on Composio Platform with managed authentication. It says that when Composio is built into a team's own agent, users connect their own accounts and Composio runs every call (Composio, checked November 2026). Metadata-only logging with a configurable 7-day-to-1-year window is the other reason to shortlist it, particularly for a team whose compliance posture says customer payloads should never leave their own systems.

Arcade wins where you need your own policy code in the request path rather than a vendor's fixed approval model. Pre- and post-call hooks let a team add custom policies without forking the runtime, and deployment can be cloud, on-prem, air-gapped or hybrid (Arcade, checked November 2026). That suits a platform team with the engineering capacity to write and run that logic, and the ongoing responsibility of maintaining it as tool definitions change upstream. Its documented client list (ChatGPT, Cursor, Claude Desktop, Claude Code, VS Code, GitHub Copilot, Copilot Studio) is the widest confirmed list among the five.

Merge Agent Handler wins where policy guardrails and DLP on every tool call are the requirement, with a searchable audit trail available on every plan rather than gated to an enterprise tier. Its FAQ says Agent Handler is free to start, with usage-based pricing plans and Enterprise custom pricing or user seats (Merge Agent Handler, checked November 2026). It is the least publicly documented of the five on specifics like client list and audit schema. That is not necessarily a product gap, but it is an information gap you'll need direct conversation with Merge to close before buying.

Elaichi wins where the bottleneck is distribution and per-person governance rather than custom policy code. One address that Claude, ChatGPT, Cursor and Microsoft Copilot all sign into, and one grant per person. Restrictions sit on roles and individuals. One audit log covers every connector, whether Elaichi wrote it or a vendor runs it. Gold carries sharing, custom roles, restrictions, custom connectors, SSO and SCIM. Black adds workflows, the Agent and logging destinations. Every new workspace gets 14-day Black trial, no credit card to start. Buying Gold or Black during the trial keeps its remaining days rather than granting a fresh 14, so it is one continuous trial, and the seats are first charged when it ends. A workspace that buys nothing moves to the free Personal plan. The honest counterweight to put against this: no in-request hook for custom policy code (that's Arcade's and Merge's lane), and the known gap on refused-at-scope calls not writing an audit row.

And the case where you do not need any of this. If one team of five uses one app and the vendor publishes its own MCP server, add that server directly. You get the vendor's permission model and nothing to maintain. The reason to buy a layer is the second and third app, the second and third client, and the reviewer who wants one place to look. When you don't need an MCP gateway yet argues that case properly, and the four gateway shapes sorts the category. At 50 or 200 seats the billing mechanics diverge sharply, which the cost comparison for smaller companies works through. For the full field rather than this shortlist, see best MCP gateways. To see what the catalog actually holds, browse the connectors.