Spend 30 minutes on six items: confirm the agent inventory, compare live tools with approved ones, remove unused grants, review exceptions, check incidents and near misses, and record decisions with owners and dates. Prepare the data beforehand so the meeting is for decisions, not data gathering.
Before the meeting
Send a pre read two days ahead. It should hold, for each agent, the approved tool list, the live tool list, call counts per tool for the period, any blocked calls, open exceptions and the time since the last review. Without this, meetings turn into guessing.
The agenda
| Minutes | Item | Output |
|---|---|---|
| 0 to 5 | Inventory: new, retired and ownerless agents | Updated registry |
| 5 to 10 | Drift: live tools not on the approved list | Each extra blocked or approved |
| 10 to 15 | Unused grants: tools with no calls this period | Removals or reasons to keep |
| 15 to 20 | Exceptions: open and expiring | Renew, narrow or close |
| 20 to 25 | Incidents, near misses and blocked calls | Control changes |
| 25 to 30 | Decisions and actions | Named owners, due dates |
Who attends
The agent sponsors or owners, a security reviewer, and someone who owns the downstream systems. A person from compliance helps if you need the minutes for audits. Keep the group small enough to decide.
Rules that keep it honest
- The reviewer cannot be the owner of the agent being reviewed.
- Every grant kept needs a stated reason. "It might be useful" is a reason to remove it.
- Decisions are applied in the manifest within a week, via pull request.
- Minutes record at least what was removed. A review with no removals deserves a second look.
- Use call data, as usage derived lists are a good starting point. Logs show what happened, so confirm rare tasks with owners.
Cadence
Quarterly suits most teams, with a faster check for agents that touch customer data or production. Add an ad hoc review after any incident or any large change to an agent's tools. The MCP specification notes servers can change their tool list, which is one more reason not to rely on a yearly review.
Minutes to keep
Date, attendees, agents reviewed, decisions, removals, actions with owners. Store them with the change records.
Safeguard offers MCP Guardrail and agent identity for applying this kind of policy to agent tool calls, and you can run a free scan of your own repositories at gold.safeguard.sh/scan. Autonomous fix pull requests are off by default, and every category starts on Manual.
Quick check
Is quarterly review too often?
For most teams it is a fair cadence. Raise it for agents with sensitive data or write access to production.
What if nobody uses a granted tool?
Remove it, after checking with the owner for rare tasks. Restoring a grant is cheaper than carrying risk.
Sources
Last reviewed: 19 October 2026.
