How to govern agentic AI, MCPs, and AI code assistants

What this post added

This post introduces a governance framework for agentic AI in software development, addressing challenges related to code attribution, traceability to intent, and documentation scalability. It details controls for MCPs, agents, model access, and tool permissions, emphasizing composite identity, tool approval guardrails, and prompt guardrails. The post also discusses data privacy and self-hosted AI options, and defines key decision points for human-in-the-loop review, including merge request approval policies and scanner enforcement. Finally, it outlines five metrics for measuring AI rollout: adoption, acceptance and quality, risk, remediation, and ROI.