AI Agent Governance for Tool Calls

Most teams start with good intentions: “Do not modify production,” “Ask before sending email,” or “Never commit secrets.” That works until the agent receives tools that can change systems.

The tool-call is the new control point

Every agent action has three parts: intent, tool name and arguments. Governance should inspect all three, not just the final text response.

• Who is the user?
• Which agent is acting?
• Which tool is being called?
• Which repo, path, API or environment is targeted?
• Is this read-only, draft, mutating or privileged?

Governance rules developers actually need

• Allow read-only repo search without approval.
• Require branch prefix for agent-generated branches.
• Force pull requests to be draft by default.
• Block .env, secrets/** and production workflow edits.
• Limit file count and diff size.
• Record every mutating action in an audit log.

Why a capability catalog helps

A raw tool list gives the agent primitives. A capability catalog gives the agent approved actions. That is the difference between “here are twenty tools” and “here are five safe workflows.”

raw tools:
  github.create_branch
  github.commit_files
  github.create_pull_request

capability:
  create_safe_draft_pr

Actlane approach

Actlane describes the capability, prompt rules, interface schema, policy and generated targets in one manifest. It can then generate the artifacts needed by MCP, OpenAPI Actions, OpenCode, VS Code or local policy checks.

Governance without blocking developers

The goal is not to slow down agents. It is to make approved workflows easy and unsafe workflows impossible or explicit.