Rolling out agent governance without stopping developers

Phase 1: discover

You cannot govern agents you do not know about. Start with an inventory of the coding agents, models, MCP servers and skills in use. Several platforms describe this step: Legit Security's VibeGuard discovers coding assistants, models and MCP servers across the engineering organization; Endor Labs' AURI inventories coding agents, models, MCP servers and skills; Cycode's AI-BOM tracks rule files, MCP servers and AI API keys with provenance; OX Security's VibeSec keeps an AI inventory.

Exit criterion: you can list every agent and MCP server in use, by team.

Phase 2: observe

Turn on logging without blocking. Watch what agents run, install and call. OX Security, for example, lists an agent activity log among VibeSec's features. Use this phase to learn which actions are common and harmless, and which are rare and risky.

Exit criterion: you have a baseline of normal agent activity and a short list of actions you would want to stop.

Phase 3: steer

Add guidance before blocking. Attach security instructions to agents, warn on risky actions, and publish the approved list of agents and MCP servers. Developers see the policy before it bites.

Exit criterion: the warnings that fire are mostly real issues, not noise.

Phase 4: block

Block the few actions that matter most, such as unapproved MCP servers, install scripts from new packages and secrets in prompts. Snyk's Evo Agentic Development Security and Legit Security's VibeGuard 2.0 both describe blocking risky agent activity. Keep the block list short, with a fast exception path.

Exit criterion: blocks are rare, exceptions are granted quickly, and nobody has switched the control off.

Running the phases by team

Run the phases team by team, not organization-wide at once. A platform team that already standardizes on one agent can move faster than a team with five. Publish the phase each team is in, so nobody is surprised by a block.

What to tell developers

Say what is collected, why, and what will be blocked and when. A rollout that explains itself gets fewer workarounds.

Signs the rollout is going wrong

• Developers ask for exceptions faster than the owner can answer them.
• A team stops using an approved agent and switches to one you cannot see.
• The inventory shrinks without anyone removing an agent, which usually means the control was disabled.

Each sign calls for a pause in the current phase, not a stricter rule. The next lesson covers how to measure whether the program works.