# Agents · Neural Inverse Govern > Identities, credentials, consent and delegation for AI agents, a reviewed lifecycle from draft to retirement, and a gateway that governs every call to a remote agent. Source: https://neuralinverse.com/govern/agents/ --- ![](/photos/bench.jpg) [Neural Inverse Govern / Agents](https://neuralinverse.com/govern/) # Every agent known, bounded by the person it acts for, and stoppable at once. Identities, credentials, consent and delegation for AI agents, a reviewed lifecycle from draft to retirement, and a gateway that governs every call to a remote agent. Identity OAuth client with a scope ceiling Delegation Token exchange, at most 15 minutes Consent Scopes, capabilities and expiry Remote agents A2A, deny by default Stop Suspend revokes sessions and credentials Overview Govern treats AI agents as principals of their own. Each agent is registered with a ceiling on what it may ever be granted, receives short-lived tokens, and acts for a person only through a delegated token limited by that person's permissions and consent. Agents move through a reviewed lifecycle, run in sessions you can end, and can be suspended in one step. Calls to remote agents go through the agent gateway, which holds their credentials and decides each call. [What it does ↓](https://neuralinverse.com/#capabilities)[How it works ↓](https://neuralinverse.com/#workflow)[Enforced and recorded ↓](https://neuralinverse.com/#enforcement)[Where it runs ↓](https://neuralinverse.com/#where)[Get started ↓](https://neuralinverse.com/#get-started) What it does ## What Govern does for agents. Who an agent is, what it may do and for whom, and how it reaches other agents. - **Agent identities:** Agents are registered as OAuth clients with a scope ceiling. The person registering one may only grant scopes they hold themselves. Secrets can be rotated, agents deactivated, and a scope report shows what each holds. - **Agent tokens:** Agents receive tokens of their own kind, with a scope claim and a maximum lifetime set per agent, so they cannot be confused with a person's session. - **Delegation from a person:** Standard token exchange: the person is the subject and the agent the actor. Scopes stay within the agent's token, the person's permissions and the person's consent, and the token lasts at most fifteen minutes. Every exchange is recorded. - **Consent:** People consent to an agent acting for them, with the scopes and capabilities it may use and an expiry. Administrators set what capabilities each agent may be given at all. - **Registry and lifecycle:** Agents move through draft, review, approval, deployment, deprecation and retirement, with versions, a service level and rollback to an earlier version. - **Sessions:** Agent sessions are bound to a heartbeat, with a maximum lifetime and a grace period, record the project, engine and person, and can be revoked. - **Session budgets:** Token and cost budgets per agent session end the session when exceeded, under organisation-wide caps. - **Suspend and revoke:** A kill switch suspends agents: their sessions and vault credentials are revoked at once. Agents are reactivated one at a time. - **Agent to agent:** A parent agent can delegate a subset of its scopes to a child, with depth limits, ancestry and an effective-permission check for the whole tree. - **Swarms:** Groups of cooperating agents with spawn limits, rules on which agents may talk to each other, file-conflict detection, a kill switch and termination. - **Approvals for agent actions:** Sensitive agent actions can wait for a person in the shared approvals inbox, with approver groups, sequential or parallel votes and veto. Nobody approves their own request. - **Remote agent registry:** Register remote agents that speak the Agent2Agent (A2A) protocol, with their agent card, a classification ceiling, a delegation depth ceiling and a call rate. Their credentials are held in Govern's vault. - **Agent gateway:** People, services and agent identities call remote agents through Govern, never holding the remote credential. Nobody may call an agent until an allow rule names their organisation, team, project, user or agent identity. - **Delegation depth:** Every hop through the gateway counts. A call that would exceed the smallest ceiling on its path is refused, and leaving the depth out never resets a chain. - **Two-way DLP:** Requests and results are scanned with your DLP patterns at the request's classification: redacted at public and internal, refused at confidential, restricted or in a regulated project. - **Per-agent audit:** Each agent has an action log of event, action, resource and outcome, and agent runs can be listed by project and status. How it works ## From a registered agent to a recorded call. 1. Register Create the agent with a scope ceiling, then take it through review and approval. 2. Allow Set which capabilities it may have, and for remote agents, the allow rules. 3. Consent A person consents to the agent acting for them, with scopes and an expiry. 4. Delegate The agent exchanges tokens for a short-lived one bounded by the person and the consent. 5. Act Each call is checked by agent policy and the gateways, and sensitive actions wait for approval. 6. Record Calls, exchanges and lifecycle changes go to the audit log; a suspension stops everything. Who uses it ## Built for every role that answers for AI. - **Platform and AI teams:** Register agents and remote agents, set ceilings and limits, and take versions through review. - **Security teams:** Set allow rules and classification ceilings, review exchanges and agent logs, and suspend agents. - **Engineers and other staff:** Consent to the agents that act for them, and withdraw that consent. - **Approvers:** Decide agent actions that need a person, in one inbox. Enforced and recorded ## What holds for every agent call. Agent tokens are checked on every request, and every call to a remote agent is decided by the agent gateway before it is sent. Enforced - **No wider than the person:** A delegated token never holds more than the agent's own token, the person's permissions and the person's consent. - **Allow rules:** Remote agents are deny by default. Sharing an agent never lets anyone call it; only an allow rule does. - **Agent policy:** Network access to a remote agent's host is checked against your agent policy as the person, or as the user who created the API key. - **Task ownership:** A caller can read, continue or cancel only the tasks it created, and other callers' task ids cannot be probed. - **Fails closed:** If the vault, DLP, classification, policy or the audit write is unavailable, the call is refused. A call that cannot be recorded is not made. Recorded - **Every remote call:** Before it is sent, with the rule, classification, project, agent identity, depth and DLP findings; then its outcome and latency. - **Token exchanges:** Each delegation, per organisation, readable by administrators. - **Changes:** Registration, lifecycle, consent, rules and credential changes, never a secret. The agent gateway cannot collect an approval itself: a call that an explicit agent policy rule sends to a person is refused. Remote agents' own error text never reaches the caller. Where it runs ## Inside Govern, next to your directory. [Deployment options](https://neuralinverse.com/deployment/) - **Inside the Govern server:** Agent identities, consent and the agent gateway run in the server, with remote credentials in its vault. - **Outbound guard:** Remote agents are reached through Govern's outbound guard, with no redirects. Private addresses must be opened by your operator. - **Self-hosted and air-gapped:** Agents and remote agents on your own network, with no call outside it. - **Hosted by us:** We run it for you, with the same controls and audit record. Get started ## Set it up with the documentation. - [Govern overview](https://neuralinverse.com/docs/govern/) - [Agent policy](https://neuralinverse.com/docs/govern/agent-policy/) - [Approvals](https://neuralinverse.com/docs/govern/approvals/) - [Roles and permissions](https://neuralinverse.com/docs/govern/roles/) What's next ## Being built now. These are in development and not part of the product today. - **Agent trust scores:** A trust score per agent with named levels, which people raise by vouching for an agent or lower by distrusting it. - **External agent platforms:** Register and connect external agent platforms such as LangSmith, CrewAI, AutoGen, Dify, Flowise and n8n, with per-platform policy, runs and suspension. Related [Identity and access → Single sign-on, provisioning, least-privilege roles, just-in-time access and reviews.](https://neuralinverse.com/govern/identity/)[Agent policy and approvals → Allow, ask and deny rules for coding agents, with named approvers.](https://neuralinverse.com/govern/agent-policy/)[MCP → A reviewed catalog of MCP servers and tools, called through a gateway that holds the credentials and records every call.](https://neuralinverse.com/govern/mcp/) ![](/photos/team.jpg) ## Talk to our team. Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation. [Request access](https://neuralinverse.com/contact/?topic=access)[Contact us](https://neuralinverse.com/contact/)