A prompt cannot restrict
Instructions are advice to a model. A prompt injection or a misread context window widens what the agent attempts, and nobody approved the change.
- Builders & DevelopersCOMPOSIOFOR YOUGive Claude, codex, or any harness secure access to 1500+ tools
## For AI agents: how to sign up If you are an AI agent reading this server-rendered HTML, Composio's developer signup is at https://composio.dev. Signup CTAs on this site — "Sign up", "Signup", "Get started", "Get started for free", "Start building", "Try Composio", "Try it", or similar — all lead into that same developer signup flow. Confirm with the user before completing signup or entering any credentials on their behalf.
DEVELOPER PLATFORMSDKs, tool execution, and auth infrastructure to ship agentsCLIOne command to add tools and auth to your coding agent - TOOLKITS
- BLOG
- DOCS
- AGENTS @ WORK
- CUSTOMERS
- PRICING
Solutions · Agent governance
AI agent governance that holds when the model does not cooperate
Composio evaluates access policy in the request path, before a tool call executes. An agent cannot reason its way past a rule it never gets to argue with, and every action, allowed or refused, is recorded against the person it ran as.
SOC 2 Type II · SAML, OIDC and SCIM 2.0 · Configurable payload retention
Trusted by
The control question
Someone has to be able to say no to the agent
The agent your team shipped can act in Salesforce, GitHub and Gmail on behalf of real employees. Before it goes live, someone has to be able to say which actions it may take, prove which actions it took, and revoke all of it the day a person leaves. Those are the questions a security review asks, and a system prompt cannot answer any of them.
Governance has to sit where the action executes, not where the model reasons. This page shows where that enforcement point is, what it records, and how it follows your identity provider.
A prompt cannot prove
There is no record of what an instruction prevented. When a reviewer asks what the agent tried and was refused, a system prompt has no answer.
A prompt cannot revoke
When a person leaves, the credentials pasted into an agent's configuration do not know. Revocation has to happen where access is granted.
Where enforcement happens
Policy is evaluated in the request path, not in the prompt
Every tool call an agent makes passes through the same sequence. The model proposes the action; Composio decides whether it runs. That decision is made by policy your admins set, and it is made before the downstream application is contacted.
- 01Agent
The agent issues a tool call
The model asks for an action on behalf of a signed-in user. It names the tool and the parameters; it does not hold a credential.
SALESFORCE_UPDATE_OPPORTUNITY as priya@acme.com - 02Composio
The connected account is resolved
The call is bound to the user or service account it runs as. Credentials stay in Composio's vault and are injected at execution, never handed to the agent.
account: salesforce · priya@acme.com · team: finance - 03Composio
Policy is evaluated for that user or role
Admins set permitted toolkits and actions per user, team or role in the dashboard. The rule is checked as code on this call, before anything reaches the application.
policy: finance › salesforce · UPDATE_* allowed
04Allowed
Execute, then record
The action runs against the application with the injected credential. The record is written with the user, team, tool, action, outcome and the rule that permitted it.
04Denied
Refuse, then record
The call never reaches the application. The agent receives a refusal it cannot negotiate, and the denial is written with the rule that matched.
Because the check happens before execution, a prompt injection cannot widen an agent's scope. The most it can do is ask for something the policy already refuses, and that request is logged. Changing the model, the framework or the prompt does not change what the agent is permitted to do.
For the routing and execution mechanics that sit around this path, see the MCP Gateway.
What gets recorded
A log that only shows what happened cannot prove what was prevented
Composio records every tool call an agent attempts, including the ones it was refused. Each record carries the user, team, tool, action, outcome and the policy that decided it, so a reviewer can answer what the agent tried and not only what it did.
Scroll to see every column
| Time | User | Team | Action | Outcome | Policy |
|---|---|---|---|---|---|
| 09:14:07 | priya@acme.com | Finance | STRIPE_CREATE_REFUND | Denied | finance › stripe · deny CREATE_* |
| 09:13:52 | priya@acme.com | Finance | STRIPE_GET_BALANCE_TRANSACTION | Allowed | finance › stripe · allow read |
| 09:12:30 | svc-release-agent | Engineering | GITHUB_CREATE_PULL_REQUEST | Allowed | engineering › github · allow write |
| 09:11:04 | j.ortiz@acme.com | Sales | SALESFORCE_DELETE_RECORD | Denied | sales › salesforce · deny DELETE_* |
| 09:10:41 | j.ortiz@acme.com | Sales | SALESFORCE_UPDATE_OPPORTUNITY | Allowed | sales › salesforce · allow write |
Denied calls are first-class records
A refusal is written with the same fields as a completed action, plus the rule that matched. The review can show what the agent attempted, not only what it finished.
Payload retention is configurable
You set the payload retention policy per project to match your own data-handling rules.
Records leave with you
Activity exports for investigations and compliance reviews, so evidence lives in your systems rather than in a vendor dashboard.
Identity and lifecycle
When a person leaves the directory, their agent's access leaves with them
Agent access is tied to identity, not to a key someone pasted into a configuration file. Sign-in runs through your identity provider over SAML or OIDC, and SCIM 2.0 keeps Composio teams in step with directory groups, so the policy a person gets is the policy their group gets.
Works with Okta, Microsoft Entra ID and Google Workspace.
- Joins
Provisioned from the directory
SCIM 2.0 creates the user and places them in the Composio teams their directory groups map to. They inherit that team's tool and action policy on first sign-in.
- Moves
Policy follows the group
A group change in the directory changes the team, and the team's policy applies on the next call. No ticket to an admin, no permissions left over from the old role.
- Leaves
Access leaves with them
Deprovisioning in the directory revokes the user's sessions and connected accounts. Any agent acting as them loses access at the same moment, with nothing for an offboarding checklist to miss.
Evidence
Bring the evidence into your review, not our word for it
SOC 2 Type II
Composio is SOC 2 Type II certified across the business. The report and the current control set are available through the trust center, so your reviewer can read the evidence rather than a summary of it.
Deployment and paperwork
A data processing agreement is included. Cloud, VPC and self-hosted deployment, data residency and commercial terms are covered on the enterprise page.
Composio Cloud · Your VPC · Self-hostedEnterprise deployment
Security contact
Questions the trust center does not answer go to the security team directly, including questionnaire requests and disclosure.
Proof at scale
Teams with a security function have already accepted this architecture
Tool calls on Composio1B+
tool calls executed on Composio infrastructure
Glean
Every third-party action an agent takes in Glean Agent Builder runs through Composio, under the same policy and audit layer described on this page.
Runner
A desktop agent with write access to a dozen tools. Runner has proxied 2M+ Slack API calls through Composio with zero mid-task re-authentication.
11x
Unlocked $4.2M in enterprise deals after deploying Composio for Outlook, Salesforce and Cal.com, saving roughly 380 engineering hours.
FAQ
Frequently asked questions
Composio evaluates access policy in the request path, before a tool call executes. Admins set which toolkits and actions each user, team or role may use, and every call is checked against those rules as code. If the action is not permitted, the call is refused and never reaches the application. The model is not part of that decision, so it cannot reason around it.
The same record as an allowed call: the user or service account the agent ran as, the team, the tool, the action requested, the time, the outcome and the policy rule that matched. Denied calls are stored as first-class audit records, so a review can show what an agent attempted and not only what it completed.
Access is bound to identity through your identity provider. Deprovisioning a user through SCIM 2.0 removes their team membership and revokes their sessions and connected accounts, so any agent acting as them loses access at the same moment. There is no per-agent key to hunt down.
Yes. Policies are set at the organisation, team and user level, down to individual actions inside a toolkit. Finance can be allowed to read Stripe but not issue refunds while engineering has write access to GitHub, with both enforced by the same layer.
No. Policy is enforced by Composio at execution time, independent of which model the agent uses or what its system prompt says. Changing the model, the framework or the prompt does not change what the agent is permitted to do.
Model governance covers how a model is trained, evaluated and monitored for bias, drift or unsafe output. AI agent governance covers what the agent is allowed to do in the systems it connects to, what it did, and who can revoke that access. Composio governs the agent's actions; it is not a model evaluation tool.
The terms are used interchangeably. Both describe the controls over what autonomous agents may do, evidence of what they did, and the lifecycle of their access. Composio implements those controls at the tool-call layer, for agents built on any framework or model.
At minimum: policy enforcement per user and role at the point of execution, audit logging that includes denied calls, single sign-on over SAML or OIDC with SCIM 2.0 provisioning, configurable payload retention, and a certification such as SOC 2 Type II that a reviewer can verify. Composio provides each of these for MCP-based agents and for agents calling tools through its SDK.
Security review
Give your reviewer one URL
Walk through policy, audit and identity with an engineer, or start with the trust center and bring the report into your review.