Governance · 2026-06-16 · 11 min
Governing MCPs and Agents — Metadata, Lifecycle, and Risk-Tiered Approval
A common metadata model, one registration-to-retirement state machine, a risk score computed from sensitivity × autonomy × action × reach, and approval paths that scale review depth to risk.
Governing the agentic layer comes down to three mechanisms: describe every asset the same way, move every asset through one lifecycle, and scale review depth to computed risk. Get those right and an agent marketplace is governable at scale; get them wrong and it is a catalog of unaccountable software.
Describe everything — the metadata model
Every asset shares a common metadata core, extended by type. Nothing gets published without it.
Common core — all assets:
- Asset ID, name, type (MCP / agent / agent team)
- Purpose — plain-language what & why
- Business area(s) + journey & stage mapping
- Business owner + technical owner (both named)
- Owning org / cost center (for chargeback)
- Status, version & changelog
- Certification tier (Sandbox → Gold) & risk tier
- Data classification touched
- SLA, support channel, cost per invocation
- Recertification due date
MCP-specific adds the connection and safety surface: endpoint, transport & environment; auto-introspected tool manifest; auth method & identity propagation; systems & data products connected; least-privilege scopes with action tools flagged; rate limits & quotas per consumer; prompt-injection / output-safety posture.
Agent-specific adds the autonomy and evaluation surface: agent pattern & autonomy level (L1–L4); model dependencies (allowlist); MCPs & tools consumed (dependency graph); human oversight points; versioned prompt/instruction register; eval results & red-team evidence; memory & data retention; escalation, fallback & regulatory scope.
The "cost per invocation" and "owning cost center" fields matter more than they look — they are what make the marketplace's economics real rather than notional.
Move everything through one lifecycle
MCPs and agents share a single state machine; the risk tier only changes how deep the review is, not the states:
Draft → Submitted → In review → Approved → Published → Deprecated → Retired
| State | What happens |
|---|---|
| Draft | Intake form or CI/CD registration; metadata capture |
| Submitted | Duplication check; manifest introspection |
| In review | Policy-as-code gates + risk-tiered human review |
| Approved | Conditions possible: autonomy caps, pilot scope |
| Published | Searchable, badged; access via entitlements |
| Deprecated | Sunset announced; consumers get a migration path |
| Retired | Access revoked; immutable audit record kept |
Two rules keep it honest: any new tool, scope expansion, model swap, or autonomy increase re-enters review (a lighter delta review for low/medium risk), and a guardrail or security incident can auto-suspend a published asset. Automated validation runs at submission — model allowlist, auth pattern, secrets vaulted, classification-vs-scopes consistency, vulnerability scan, action-tool inventory.
Compute risk, then scale the review
Risk is not a gut call. It is computed:
risk = data_sensitivity × autonomy_level × action_capability × user_reach
→ Low / Medium / High / Critical
An agent that only suggests over public data is Low; an autonomous agent transacting on regulated systems with broad reach is Critical. The tier sets the approval path and SLA:
| Risk tier | Review path | SLA | Example |
|---|---|---|---|
| Low | Domain steward (single approver) | 2 business days | Read-only MCP over public product data |
| Medium | Domain steward + Security review | 5 business days | Agent drafting content, human-reviewed output |
| High | AI Governance Board (Security, Privacy, Legal, Domain, Architecture) | 10 business days | PHI-adjacent audience agent with action tools |
| Critical | Governance Board + executive sign-off + mandatory red-team eval | 15–20 business days | Autonomous agent transacting on regulated systems |
Reviewers all see the same review dossier: metadata, auto-check results, eval scores, dependency graph, and a similar-asset comparison. Outcomes are bounded: approve / approve with conditions / return with findings / reject.
Who does what — clear accountability
Every stage has an owner, on a simple RACI:
| Role | Responsibility |
|---|---|
| Requestor / builder | Registers the asset, supplies metadata and eval evidence, responds to findings, attests at recertification |
| Business owner | Accountable for business fit, purpose, and value; signs off publication, recertification, retirement |
| Domain steward | Approves low-risk assets; curates the domain's journey catalog; first line for duplication and quality |
| Security & privacy | Reviews medium+ risk: classification, PII/PHI handling, auth, prompt-injection posture |
| AI governance board | Approves high & critical risk; owns policy-as-code rules, model allowlist, certification standards |
| Platform team | Runs the marketplace: automated validation, telemetry, dependency graph, access provisioning, retirement mechanics |
Recertification keeps it from rotting: owners attest quarterly (Gold) to annually (Bronze), and a lapsed attestation auto-deprecates the asset.
The path to implement
- Make complete metadata mandatory at intake — no metadata, no publication.
- Implement the single lifecycle state machine with automated validation at submission.
- Compute the risk tier from sensitivity × autonomy × action × reach.
- Route to risk-tiered approval paths with explicit SLAs and one shared review dossier.
- Enforce recertification so lapsed attestation auto-deprecates.
This is human-in-the-loop governance and policy-as-code compliance applied to the agentic layer. Incipient's GovPilot and Data Marketplace accelerators provide the policy engine, audit trail, and registry to run it.