Govern AI agent tool calls: policies, posture and audit

These pages are for policy authors. They follow the path of a request through Wanaku: the rules that decide it, the credentials and data controls that apply to it, and the evidence that it leaves.

Rules

• Governance Posture: set the enforcement mode, the fail-safe defaults, and namespace resolution.
• Action Policies: write deterministic rules that allow or deny MCP actions.
• Evaluators: configure evaluators, their triggers, and their processors.
• Evaluator engines: configure the LLM, TypeSafe System One, OPA, and passthrough engines.

Credentials and data

• Credential Brokerage: give forwards scoped, fail-closed upstream credentials.
• Redaction boundary: learn where Wanaku removes credentials and PII.

Evidence

• Governance audit trail: read audit events, redaction rules, and retention.
• Policy Simulation: validate candidate policies and compare decisions before you activate them.

Tutorials

• Govern an MCP server: put one MCP server behind a credential binding, action-policy rules, and an LLM evaluator.
• Gate tool calls with OPA: allow or deny tool calls with a Rego policy.

Next steps

• Getting Started with Wanaku: run a server to try these rules on.
• Wanaku configuration file: find where each governance setting goes in wanaku.yaml.