The questions people ask about governing AI agents.
Plain answers to how Agentomy works, from the first governed action to compliance proof. If you are new, start with the first question; if you know the space, jump to what you need.
- What is AI agent governance?
- What is Agentomy?
- How do I set up governance for my AI agents?
- How do I govern MCP agents and tool calls?
- How do I monitor AI agents for drift or compromise?
- Can I stop an AI agent instantly?
- How do I prove AI agent compliance for the EU AI Act, SOC 2, or HIPAA?
- How do I test my agent platform against the OWASP Agentic Top 10?
- Does my data leave my environment?
- Which agent frameworks does Agentomy support?
What is AI agent governance?
AI agent governance is the discipline of answering three questions at the moment an agent acts, not after: was this action authorized, can the record of it be proven to a third party, and could a human have stopped it. In practice it covers authorization enforcement, a tamper-evident audit trail, behavioral monitoring, and an emergency stop, all applied before the action rather than discovered later in the logs. Agentomy is the governance layer that provides this for agents on any framework, vendor, or cloud.
What is Agentomy?
Agentomy is a vendor-neutral governance layer for AI agents in regulated enterprises. It provides enterprise-wide discovery, policy enforcement, and compliance proof across every AI agent, model, and application, regardless of the framework or deployment. It runs self-hosted, so it governs the agents you already have without asking you to change them.
How do I set up governance for my AI agents?
Start with agentomy-agent, a free-forever governance peer you install in about thirty seconds with no account and no API key. It gives you agent discovery, permission limits, behavioral monitoring, and an honest posture score against GovernanceBench on your own machine. When you need cryptographic audit and enforcement you can show an auditor, you connect the self-hosted platform.
How do I govern MCP agents and tool calls?
The MCP Gateway interposes on any stdio MCP server and governs every tool call, failing closed on anything unauthorized. Because it sits in front of the server rather than inside your agent, MCP governance does not require changing your agent's code.
How do I monitor AI agents for drift or compromise?
Agentomy runs behavioral monitoring on every action against each agent's own rolling baseline, watching for privilege probing, scope escalation, frequency spikes, and identity drift. When an agent starts behaving unlike itself, the action is flagged or the agent is halted. This is agent observability aimed at governance, not uptime.
Can I stop an AI agent instantly?
Yes. A fleet-wide emergency halt stops every governed agent, returns a confirmed halt count, and survives an infrastructure restart. It works for one agent or a thousand, and every halt is recorded in the audit trail.
How do I prove AI agent compliance for the EU AI Act, SOC 2, or HIPAA?
Every governance decision is written into a tamper-evident, hash-linked audit chain you can export and independently verify. The platform maps controls to the EU AI Act, SOC 2, HIPAA, ISO 27001, and PCI DSS. These are self-assessed readiness mappings, not third-party certification, a distinction we state plainly, because a governance product cannot claim what it has not earned.
How do I test my agent platform against the OWASP Agentic Top 10?
Point the open GovernanceBench and VIGIL suites at any platform, including your own. GovernanceBench scores six governance dimensions, VIGIL runs an adversarial and prompt-injection battery, and the Kevlar suite covers the OWASP Agentic Top 10. The score is honest because the methodology is open and the benchmarks are reproducible.
Does my data leave my environment?
It depends on the deployment mode, and the answer is stated per mode rather than universally. Self-hosted: governance runs where your agents run and your data never leaves your environment. Shared and dedicated plans run on Agentomy-operated infrastructure, so governance decisions and audit records for those workspaces are processed and retained there for the plan's retention period. Dedicated (Enterprise) is an isolated per-customer instance operated by Agentomy. In every mode you bring your own model key; on Agentomy-hosted plans it is encrypted at rest, held only as ciphertext with a masked hint, and used solely to call your model.
Which agent frameworks does Agentomy support?
Agentomy is vendor-neutral by design. It governs agents across frameworks, models, and clouds through framework adapters and standard integration paths (SDK, REST API, MCP, lifecycle hooks, CLI), so no auditor is ever asked to accept the agent vendor grading its own homework.