Capability tokens
Short-lived, task-scoped tokens bound to tenant, user, mission and attempt. Stored only as keyed hashes; revoking one revokes everything delegated from it.
Insiro Governance
Govern every MCP tool in clicks, not code.
Set any tool to off, read-only or read and write. Require approval by risk. Then see exactly which actions ran for which user question, and how many tokens each step burned. No hustle, no YAML spelunking.
MCP controlsRead-only modeApprovalsKill switchesDLPTelemetry
| Tool | Access | Risk |
|---|---|---|
 salesforce.update_record | tier 2 | |
 github.create_issue | tier 1 | |
 gmail.send_email | tier 2 | |
 snowflake.execute_sql | tier 1 | |
 jira.delete_issue | tier 3 |
Require approval for tier 2+
Redact PII in outputs
Kill switch
- 2m jira.delete_issue set to Off by admin · audited
What is MCP governance?
MCP governance means controlling which Model Context Protocol tools AI agents can discover and call, with what arguments, under whose credentials, and recording every decision. Insiro routes every MCP call through one gateway that enforces permissions, rate limits, risk-tier approvals, DLP and budgets, and writes audit evidence.
- 3access levels: off, read, write
- 4risk tiers with approvals
- 13checks on every tool call
- Everyquery traced to tools and tokens
MCP controls
Read-only with one click. Write access when it's earned.
Every MCP server and tool your agents can reach appears in one list with its owner, risk tier, rate limit and scope. Change access with a segmented control; the gateway enforces it on the next call.
- Off / Read only / Read + write per tool, per workspace or Space.
- Register new MCP servers from the console, no deployment required.
- Risk tiers 0 to 3 with confirmation at tier 2 and owner approval at tier 3.
- Kill switches per tool for org admins; platform-wide for operators.
Why Insiro, not the alternativesMost teams govern MCP by editing config files and redeploying a proxy. In Insiro the policy is a UI decision that takes effect instantly and is audited with who changed it, so security can own it without filing an engineering ticket.
billing-mcp
User OAuth (delegated)
https://mcp.internal.example/billing
Discovered 4 tools Connected · 212ms
| list_invoices | Read only | tier 0 |
| get_customer | Read only | tier 0 |
| create_credit_note | Off until approved | tier 2 |
| void_invoice | Off until approved | tier 3 |
New write tools start Off. Read tools start Read only.Publish to Finance Space
Telemetry
Every answer, explained down to the token.
Telemetry connects the user's question to the intent the router chose, each tool it called, the permission decision and the tokens and credits at every level. Click any trace to open it.
- KPIs: active agents, goal success rate, latency (avg and P95), error rate, credits, token efficiency.
- Traces filterable by agent and outcome: achieved, partial, tool error, awaiting approval, failed.
- Tool usage: calls, success rate, retries and latency for every tool.
- Evidence explorer: search by trace, user or tool, with input and output hashes.
Why Insiro, not the alternativesObservability tools show model calls; admin consoles show usage totals. Insiro joins them: one trace from the user's words, through every MCP action and permission check, to the exact token cost.
Tool calls
18,204
Tokens
42.7M
Blocked
37
P95 latency
2.1s
| User query | Outcome | Tokens | Cost |
|---|---|---|---|
| "Close out stale Q3 opportunities" · a.khan | Awaiting approval | 48,210 | $0.31 |
| |||
| "Top 10 SKUs by margin last month" · j.ortiz | Goal achieved | 12,904 | $0.07 |
| |||
| "Email the board deck to finance@" · r.lee | Blocked · DLP | 2,310 | $0.01 |
Click a trace to see every step, tool and token count.
Budgets
One account per mission. No surprise bills.
Model tokens, tools, sandbox minutes, search and storage all draw from a single budget with an approved ceiling. Cost is reserved before work runs and settled after, so overruns are visible and rare.
- Org → user → goal cost ceilings, with user overrides where allowed.
- Allocated, reserved, settled, released and available, by category.
- Clean stop at the limit, with a clear "Out of budget" status.
Enrich 40 inbound leads and score them
INSIROCAP $5.00
$2.86 LEFT
AGENT BUDGET · GOAL 2194
Web search ×22$0.22
Enrichment ×40$1.20
Model tokens$0.64
Sandbox · 41s$0.08
Settled$2.14
Overrun$0.00
SETTLED
Defense in depth
Every control an enterprise asks for.
DLP in and out
Block sensitive inputs per tool policy; outputs are always scanned and redacted before they reach a model or a person.
Rate limits
Sliding per-user, per-tool windows from the tool manifest stop runaway loops before they cost money.
RBAC and Spaces
Roles, groups and Spaces decide who can see which agents, data sources and tools.
Hash-chained audit
Append-only mission history and an evidence service that fails closed: no audit write, no tool call.
Feature flags
Roll out risky capabilities by org, user or percentage with a policy engine, and roll them back instantly.
Why Insiro
Governance vs. the alternatives.
| Capability | Insiro Governance | Homegrown MCP proxy | Copilot admin centres | LLM observability tools |
|---|---|---|---|---|
| Per-tool off / read / write in UI | Clicks, instant | Config and redeploy | Per app | Not in scope |
| Risk-tier approvals bound to exact args | Single-use, 5-minute tokens | Build it | Basic | No |
| Kill switch by tool, user, workspace, org | Yes | Partial | Per app | No |
| DLP on tool input and output | Yes | Build it | Varies | No |
| Query → tool → token trace | Every step | Logs only | Usage totals | Model calls only |
| Budget reserve and settle | Per mission | No | No | No |
| Fail-closed audit evidence | Yes | Best effort | Activity log | Traces |
What is Insiro Governance?
Insiro Governance is the control plane for AI agents and MCP tools. Admins set each tool to off, read-only or read and write with clicks, require approvals by risk tier, apply kill switches and DLP, and use telemetry to see which tools ran for which user query and how many tokens each step consumed.
What is MCP governance?
MCP governance means controlling which Model Context Protocol tools AI agents can discover and call, with what arguments, under whose credentials, and recording every decision. Insiro routes every MCP call through one gateway that enforces permissions, rate limits, risk-tier approvals, DLP and budgets, and writes audit evidence.
How do I make an MCP tool read-only in Insiro?
Open MCP controls in the admin console, find the tool or server, and choose Read only. The policy is pushed to the gateway immediately: write actions from that tool are blocked for every agent, teammate and pipeline in scope, and the change is recorded in the audit trail with who made it.
What does Insiro telemetry show?
Telemetry shows active agents, success rates, latency, error rates, credits and token usage over time, plus a trace for every run. Each trace lists the user's query, the routed intent, every tool call with its permission decision, and input and output tokens and cost at each step.
Can we stop all agents immediately in an emergency?
Yes. Org admins have per-tool kill switches in the governance console, and platform kill switches can target a tool, a user, a workspace or a whole organisation. Kill switches take effect on the next tool call; the platform switch fails closed if its state cannot be read.
Does Insiro protect sensitive data in agent outputs?
Yes. Inputs to tools are scanned and can be blocked per tool policy. Outputs are always scanned and redacted, covering identifiers such as social security numbers, card numbers, email addresses, password or token assignments and long secrets, before results reach the model or the user.
How are agent costs controlled?
Every goal and mission has one budget account with an approved ceiling. Model calls, tools, sandbox time, search and storage reserve estimated cost before running and settle actual usage afterwards. When the ceiling is reached, work stops cleanly and the itemised spend is visible in telemetry.
Show your security team the controls first.
We walk through MCP controls, approvals, DLP and telemetry on a live workspace, then answer your security questionnaire.
- 13checks on every tool call
- 4risk tiers with approvals
- 100%of tool calls audited