← Governing coding agents Self-assessment For each point, answer honestly for your organization today: yes, partly or no. You get a score, a readiness band and the three gaps to close first. It runs in your browser; nothing is sent or stored.
1 Write down what each agent may do Every agent has a written scope, and the platform enforces it.
2 Give every agent its own identity You can name which agent made any change, and revoke it in minutes.
3 Send every model call through one gateway No production path calls a model except through the gateway.
4 Govern the tools as well as the models Unregistered tool servers are blocked by default.
5 Curate the context agents read Every context source an agent reads has an owner and a review date.
6 Put policy in the pipeline A change that breaks a standard fails the build, with a named waiver path.
7 Keep maker and checker separate No agent can approve its own change, and high-impact paths require named approvers.
8 Record provenance for every change For any production change, you can show the agent, the inputs and the approver.
9 Scan everything agents add Every merged change has passed dependency, secret and license checks.
10 Use specs for high-risk changes High-risk changes link to an approved spec, and tests trace to it.
11 Measure outcomes, not usage Every pilot has a baseline, a target and a gate before it scales.
12 Plan for the bad day You can disable any agent in minutes and have rehearsed doing it.
Your result Answer all 12 points to see your score. 12 to go.