Access and identity
- Which AI agents can call tools in this workflow?
- Does each agent have separate credentials, environment and trust level?
- Can one agent be revoked without rotating every workflow credential?
Security review template
Questions every buyer should ask before approving AI agent tool access
Use this template when reviewing AI coding agents, internal copilots, automation workers or MCP server rollouts. AgentGate is designed to answer these questions with runtime policy, approvals, redaction and audit evidence.
Tool and MCP server scope
- Which MCP servers are reachable?
- Which tools can read, write, deploy, export data or trigger payment actions?
- Are new or unknown tools denied by default?
Policy and approvals
- Which calls are allowed automatically?
- Which calls require human approval?
- Do approval tokens expire and resist replay?
Audit and data protection
- Is every allow, deny, approval-required and error decision recorded?
- Are secrets and customer data redacted before logging?
- Can audit records be exported for customer reviews or incident response?
Operations
- What happens if policy evaluation fails?
- How are open risk alerts triaged?
- Who owns approval SLA and payment-required notices?
Answer the review with live controls, not a promise
Start a live workspace and produce approval and audit evidence from one MCP workflow.