Skip to main content
Follow this path to put Tool Governance live on an Agent Graph. LLM safety is a separate chapter: Guardrails setup.

​
Prerequisites

  • Professional or Enterprise (Pro+)
  • Workspace role that can create/attach policies (workspace.governance.create / attach)
  • Workspace Governance page itself is Admin / Superadmin only; Studio configuration works with broader read/write perms

​
Path A — Create and attach a tool policy in Studio

​
1. Open Studio Governance

  1. Open the Agent Graph in Graph Studio.
  2. Click Governance in the Studio rail (?tab=governance).
  3. Open Summary, then Tool Governance (or the Tool Governance tab).

​
2. Create policy — Details

  1. Start New policy (create wizard).
  2. Step Details:
    • Name (required — placeholder Policy name)
    • Description (placeholder Describe what this policy controls)
  3. Click Continue to Tools.
Validation: Enter a policy name before continuing.

​
3. Create policy — Tools

  1. Select at least one tool from the catalog (Integration Hub, MCP, or code runner).
  2. Click Continue to the next step.
Validation: Select at least one tool integration.
  • If you only selected code runner tools → next step is Sandbox config (skip Actions).
  • If you selected actionable (non–code-runner) tools → next is Actions & arguments.

​
4. Create policy — Actions & arguments (when shown)

  1. For each tool action, set the effect:
    • Allow — call proceeds (optional argument rules)
    • Human approval — pause for a person (Approvals)
    • Deny — block (default for actions you do not change)
  2. Configure argument constraints when Allow or Human approval needs them.
  3. Continue.
Copy in product: all actions default to deny unless you change them.

​
5. Create policy — Sandbox config (when code runner selected)

  1. Optionally enable Kill switch / Disable all code execution and set Reason.
  2. Set Limits: Timeout (seconds), Max output bytes, Max code size bytes, Max input size bytes.
  3. Set Env variable filtering to allowlist or denylist.
  4. Continue to Review.

​
6. Create policy — Review

  1. Read the Policy document.
  2. Optional Test policy (simulate): pick env (Development / UAT / Production), action, channel id, Simulate.
  3. Save the policy — it appears in the Library.

​
7. Attach the policy

  1. On Tool Governance, find the policy under Library.
  2. Click Attach (or Attach governance).
  3. Step Attach policy:
    • Apply to: Entire flow or One agent
    • Confirm the workspace policy selection
  4. If the policy has Human approval rules, continue to Approval delivery:
    • Channels: Dashboard and/or Email
    • Users (email recipients) when Email is on
  5. Finish attach. Binding type is policy.
In Use shows the policy on this flow version (Edit, Detach, Attach HIL, Approval delivery).

​
8. (Optional) HIL New profiles

If you need richer destinations than Dashboard/Email:
  1. Open HIL New.
  2. Create a profile (Dashboard / Slack / Microsoft Teams).
  3. Attach to tools that need HIL.
See HITL — Slack/Teams are preview until the profile API ships.

​
9. Triage approvals

  1. When a run hits Human approval, open OPERATE → Governance → Approvals or Studio HIL Approvals.
  2. Filter Pending.
  3. Accept or Reject.
Full decide flow: Approvals.

​
Path B — Workspace operate view

  1. As Admin, open OPERATE → Governance.
  2. Policies — watch decisions, rule mix, approvals resolved (7 / 30 / 90 days).
  3. Approvals — same inbox as Studio.
  4. Guardrails tab — analytics only; create/attach profiles in Studio (Guardrails).
  5. Budget — Soon (not available).

​
Checklist

  • Policy saved in Library
  • Policy In Use on the flow (or agent)
  • HITL policies have Approval delivery (Dashboard and/or Email)
  • Graph Saved and Built so the binding ships with the build
  • Test a deny / approval path in DEV