How to govern agentic AI, MCPs, and AI code assistants

This post introduces a governance framework for agentic AI in software development, focusing on identity, permissions, and auditability. It details controls for Model Context Protocol (MCPs), agents, model access, and tool permissions, including composite identity, tool approval guardrails, and prompt guardrails. It also discusses data privacy, self-hosted AI options, and the importance of human-in-the-loop decisions for code review, testing, and deployment. Finally, it proposes five metrics for measuring AI rollout: adoption, acceptance and quality, risk, remediation, and ROI.