Agent Governance — onboard & integrate.

Agent Governance is a standalone feature. A company member files a licence request from the pricing page or the governance hub; a super-admin approves it. Only that feature is granted — nothing else changes.

Members request; a super-admin approves. Feature access is company-scoped and fails closed — an unlicensed call returns 402.

Top up a credit wallet via Stripe. Billing meters once per new agent the first time it is governed — idempotent, so re-onboarding the same agent never double-charges. Viewing stays free; you pay when an agent is actually governed.

Point your assistant or workload at the MCP server and approve a one-time secure sign-in (OAuth 2.1). A company Owner or Security Manager approves the link, once.

# remote MCP server
https://mcp.aribot.ayurak.com/

Aribot is itself an A2A agent. It publishes a signed Agent Card at/.well-known/agent-card.json, so other agents can discover and speak to it natively.

Three ways in — you never hand-enter agents:

• Auto-provision (MCP). An agent connects and signs in; its identity is created on first contact.
• A2A card. Post an Agent Card — name, url, provider, version — and it maps to an identity, grouped into a provider-version cohort.
• Bulk register. One call registers a whole cohort over REST or the onboarding tool.

POST https://api.aribot.ayurak.com/aribot-api/v2/gateway/onboard
{ "cohort": "payments-fleet", "agents": [ … ] }

From then on, every action an agent takes — over REST, MCP, or in-app — passes one governed control point: authenticate, check the licence, check consent and role, confirm the action is allowed, a real-time stop check, a threat check, then run — and only then record and meter it. The sequence is ordered and fails closed.

It warns before it blocks: a first novel action alerts, a second within the window isolates the agent (never auto-terminates), and a timeout releases it.

Turn governance on in observe-only first. You see exactly what would have been alerted or held, on your real traffic, before anything is blocked — so enforcement is a decision you make with evidence, not a leap.

Every governed action leaves a record of what was permitted and what was refused — refusals included, because they are the only positive evidence a control was engaged. The record is retained on your policy and built to be verified independently, by someone who has no reason to trust the party that wrote it.