# AI Agent Governance | Composio

AI agent governance for enterprise: access policy enforced in the request path before a tool call runs, audit trails that record denied actions, SSO and SCIM 2.0 lifecycle, SOC 2 Type II.

## Evidence and deployment

Composio is SOC 2 Type II certified across the business. The report and current control set are available through the trust center. A data processing agreement is included. Cloud, VPC and self-hosted deployment, data residency and commercial terms are covered on the enterprise page.

- [Trust Center and security evidence](https://trust.composio.dev/)
- [Enterprise deployment](https://composio.dev/enterprise)
- [MCP Gateway](https://composio.dev/mcp-gateway)
- [Contact the team](https://composio.dev/contact)
- [Security questionnaires and disclosure](mailto:security@composio.dev)

## Frequently asked questions

### How do you stop an AI agent from taking an action it was not authorised to take?

Composio evaluates access policy in the request path, before a tool call executes. Admins set which toolkits and actions each user, team or role may use, and every call is checked against those rules as code. If the action is not permitted, the call is refused and never reaches the application. The model is not part of that decision, so it cannot reason around it.

### What is recorded when an agent action is denied?

The same record as an allowed call: the user or service account the agent ran as, the team, the tool, the action requested, the time, the outcome and the policy rule that matched. Denied calls are stored as first-class audit records, so a review can show what an agent attempted and not only what it completed.

### How does agent access get revoked when someone leaves?

Access is bound to identity through your identity provider. Deprovisioning a user through SCIM 2.0 removes their team membership and revokes their sessions and connected accounts, so any agent acting as them loses access at the same moment. There is no per-agent key to hunt down.

### Can access policies differ per team?

Yes. Policies are set at the organisation, team and user level, down to individual actions inside a toolkit. Finance can be allowed to read Stripe but not issue refunds while engineering has write access to GitHub, with both enforced by the same layer.

### Does policy enforcement depend on the model or the prompt?

No. Policy is enforced by Composio at execution time, independent of which model the agent uses or what its system prompt says. Changing the model, the framework or the prompt does not change what the agent is permitted to do.

### What is the difference between governing an AI agent and governing an AI model?

Model governance covers how a model is trained, evaluated and monitored for bias, drift or unsafe output. AI agent governance covers what the agent is allowed to do in the systems it connects to, what it did, and who can revoke that access. Composio governs the agent's actions; it is not a model evaluation tool.

### Is agentic AI governance the same as AI agent governance?

The terms are used interchangeably. Both describe the controls over what autonomous agents may do, evidence of what they did, and the lifecycle of their access. Composio implements those controls at the tool-call layer, for agents built on any framework or model.

### What should an enterprise MCP governance platform include?

At minimum: policy enforcement per user and role at the point of execution, audit logging that includes denied calls, single sign-on over SAML or OIDC with SCIM 2.0 provisioning, configurable payload retention, and a certification such as SOC 2 Type II that a reviewer can verify. Composio provides each of these for MCP-based agents and for agents calling tools through its SDK.

Canonical URL: https://composio.dev/solutions/ai-agent-governance