Neural Inverse Govern / Agents
Every agent known, bounded by the person it acts for, and stoppable at once.
Identities, credentials, consent and delegation for AI agents, a reviewed lifecycle from draft to retirement, and a gateway that governs every call to a remote agent.
- Identity
- OAuth client with a scope ceiling
- Delegation
- Token exchange, at most 15 minutes
- Consent
- Scopes, capabilities and expiry
- Remote agents
- A2A, deny by default
- Stop
- Suspend revokes sessions and credentials
Overview
Govern treats AI agents as principals of their own. Each agent is registered with a ceiling on what it may ever be granted, receives short-lived tokens, and acts for a person only through a delegated token limited by that person's permissions and consent. Agents move through a reviewed lifecycle, run in sessions you can end, and can be suspended in one step. Calls to remote agents go through the agent gateway, which holds their credentials and decides each call.
What it does
What Govern does for agents.
Who an agent is, what it may do and for whom, and how it reaches other agents.
Agent identitiesAgents are registered as OAuth clients with a scope ceiling. The person registering one may only grant scopes they hold themselves. Secrets can be rotated, agents deactivated, and a scope report shows what each holds.
Agent tokensAgents receive tokens of their own kind, with a scope claim and a maximum lifetime set per agent, so they cannot be confused with a person's session.
Delegation from a personStandard token exchange: the person is the subject and the agent the actor. Scopes stay within the agent's token, the person's permissions and the person's consent, and the token lasts at most fifteen minutes. Every exchange is recorded.
ConsentPeople consent to an agent acting for them, with the scopes and capabilities it may use and an expiry. Administrators set what capabilities each agent may be given at all.
Registry and lifecycleAgents move through draft, review, approval, deployment, deprecation and retirement, with versions, a service level and rollback to an earlier version.
SessionsAgent sessions are bound to a heartbeat, with a maximum lifetime and a grace period, record the project, engine and person, and can be revoked.
Session budgetsToken and cost budgets per agent session end the session when exceeded, under organisation-wide caps.
Suspend and revokeA kill switch suspends agents: their sessions and vault credentials are revoked at once. Agents are reactivated one at a time.
Agent to agentA parent agent can delegate a subset of its scopes to a child, with depth limits, ancestry and an effective-permission check for the whole tree.
SwarmsGroups of cooperating agents with spawn limits, rules on which agents may talk to each other, file-conflict detection, a kill switch and termination.
Approvals for agent actionsSensitive agent actions can wait for a person in the shared approvals inbox, with approver groups, sequential or parallel votes and veto. Nobody approves their own request.
Remote agent registryRegister remote agents that speak the Agent2Agent (A2A) protocol, with their agent card, a classification ceiling, a delegation depth ceiling and a call rate. Their credentials are held in Govern's vault.
Agent gatewayPeople, services and agent identities call remote agents through Govern, never holding the remote credential. Nobody may call an agent until an allow rule names their organisation, team, project, user or agent identity.
Delegation depthEvery hop through the gateway counts. A call that would exceed the smallest ceiling on its path is refused, and leaving the depth out never resets a chain.
Two-way DLPRequests and results are scanned with your DLP patterns at the request's classification: redacted at public and internal, refused at confidential, restricted or in a regulated project.
Per-agent auditEach agent has an action log of event, action, resource and outcome, and agent runs can be listed by project and status.
How it works
From a registered agent to a recorded call.
- RegisterCreate the agent with a scope ceiling, then take it through review and approval.
- AllowSet which capabilities it may have, and for remote agents, the allow rules.
- ConsentA person consents to the agent acting for them, with scopes and an expiry.
- DelegateThe agent exchanges tokens for a short-lived one bounded by the person and the consent.
- ActEach call is checked by agent policy and the gateways, and sensitive actions wait for approval.
- RecordCalls, exchanges and lifecycle changes go to the audit log; a suspension stops everything.
Who uses it
Built for every role that answers for AI.
Platform and AI teamsRegister agents and remote agents, set ceilings and limits, and take versions through review.
Security teamsSet allow rules and classification ceilings, review exchanges and agent logs, and suspend agents.
Engineers and other staffConsent to the agents that act for them, and withdraw that consent.
ApproversDecide agent actions that need a person, in one inbox.
Enforced and recorded
What holds for every agent call.
Agent tokens are checked on every request, and every call to a remote agent is decided by the agent gateway before it is sent.
Enforced
No wider than the personA delegated token never holds more than the agent's own token, the person's permissions and the person's consent.
Allow rulesRemote agents are deny by default. Sharing an agent never lets anyone call it; only an allow rule does.
Agent policyNetwork access to a remote agent's host is checked against your agent policy as the person, or as the user who created the API key.
Task ownershipA caller can read, continue or cancel only the tasks it created, and other callers' task ids cannot be probed.
Fails closedIf the vault, DLP, classification, policy or the audit write is unavailable, the call is refused. A call that cannot be recorded is not made.
Recorded
Every remote callBefore it is sent, with the rule, classification, project, agent identity, depth and DLP findings; then its outcome and latency.
Token exchangesEach delegation, per organisation, readable by administrators.
ChangesRegistration, lifecycle, consent, rules and credential changes, never a secret.
The agent gateway cannot collect an approval itself: a call that an explicit agent policy rule sends to a person is refused. Remote agents' own error text never reaches the caller.
Inside the Govern serverAgent identities, consent and the agent gateway run in the server, with remote credentials in its vault.
Outbound guardRemote agents are reached through Govern's outbound guard, with no redirects. Private addresses must be opened by your operator.
Self-hosted and air-gappedAgents and remote agents on your own network, with no call outside it.
Hosted by usWe run it for you, with the same controls and audit record.
Get started
Set it up with the documentation.
What's next
Being built now.
These are in development and not part of the product today.
Agent trust scoresA trust score per agent with named levels, which people raise by vouching for an agent or lower by distrusting it.
External agent platformsRegister and connect external agent platforms such as LangSmith, CrewAI, AutoGen, Dify, Flowise and n8n, with per-platform policy, runs and suspension.
Talk to our team.
Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.