How to govern Security in Agent Governance Toolkit
A step-by-step guide to governing Security in Agent Governance Toolkit with Rencore: detect, review by owner and severity, and remediate with an audit trail.
Governing Security in Agent Governance Toolkit means finding where it goes wrong, reviewing the findings by owner and severity, and remediating with an audit trail. Rencore covers this concern for Agent Governance Toolkit with the pre-built controls below, so it becomes a repeatable check rather than a one-off cleanup. The steps that follow apply the same detect, review, remediate loop to Security.
Steps
-
Inventory Agent Governance Toolkit
Connect Agent Governance Toolkit and let Rencore build a continuous inventory of its resources, owners, and configuration, so governance starts from what exists rather than a stale export.
-
Detect with policies
Turn on the pre-built policies that cover Security in Agent Governance Toolkit to surface oversharing, sprawl, and misconfiguration on the first scan, before writing a single custom rule.
-
Review by owner and severity
Use the Agent Governance Toolkit reports to review findings by owner, category, and severity, and to share them with stakeholders who do not have a seat in the platform.
-
Remediate and automate
Apply automations to fix findings at scale, route sensitive changes through approvals, and keep every action reversible and logged for the audit trail.
Agent Governance Toolkit controls for Security
Grounded in the Rencore catalog. See the full Agent Governance Toolkit catalog on the Agent Governance Toolkit connector page.
-
Prompt injection detected in last 24h
Detects PROMPT_INJECTION_DETECTED audit events emitted by AGT in the last 24 hours.
Severity: High -
Content violation detected in last 24h
Detects CONTENT_VIOLATION audit events emitted in the last 24 hours.
Severity: High -
MCP tool poisoning detected in last 24h
Detects MCP_TOOL_POISONING audit events raised by the AGT MCP Security Gateway in the last 24 hours.
Severity: High -
Policy deny decision in last 24h
Surfaces policy_decision = deny rows from the AGT audit stream within the last day.
Severity: Medium -
Agent denial spike (5+ denies in lookback window)
Detects agents with five or more policy_decision = deny rows within the configured lookback window.
Severity: Medium -
Identity rejection in last 24h
Detects IDENTITY_REJECTED audit events in the last 24 hours.
Severity: High -
Tool call blocked in last 24h
Detects TOOL_CALL_BLOCKED audit events in the last 24 hours.
Severity: Medium -
Agent observed in lookback window
Risk-probability multiplier: agents currently producing AGT events have a live blast radius.
Severity: Medium -
Agent has hit a policy guardrail
Risk-probability multiplier: agents with one or more policy_decision = deny rows operate near the guardrail, raising the likelihood that a weakness becomes an incident.
Severity: Medium -
High-volume agent (40+ events in lookback window)
Risk-probability multiplier: agents with high event throughput have a larger exposure surface, raising the likelihood that a weakness manifests.
Severity: Medium -
Top agents by deny decisions
Agents (by DID) with the most policy_decision = deny rows in the lookback window.
-
Blocked tool calls by action
Count of TOOL_CALL_BLOCKED events grouped by action.
-
Identity rejections by agent
Per-agent count of IDENTITY_REJECTED audit events.
-
Policy decisions: deny
All policy_decision = deny rows in the lookback window.
-
Policy decisions: warn
All decision = warn rows in the lookback window.
-
Identity rejections
IDENTITY_REJECTED audit events in the lookback window.
-
Blocked tool calls
All TOOL_CALL_BLOCKED audit events in the lookback window.
