Record eight things for every change to an agent's tool access: the agent, the change, the reason, the requester, the approver, the date, the expiry and a link to the evidence. Together they let an auditor replay who gave which authority to which agent, and why.
Why this record matters
Auditors rarely ask whether an agent has permissions. They ask how those permissions were approved and whether anyone checked them since. Without a change record, you can show the current state but not the decision behind it. The MCP specification tells clients to log tool usage for audit purposes, which covers what the agent did. The change record covers what it was allowed to do.
The record
| Field | Example |
|---|---|
| Agent identity | billing-summary-agent |
| Change | add tool invoices.read, scope one customer group |
| Reason | monthly summary task, ticket reference |
| Requester | named team member |
| Approver | named person, different from requester |
| Decision date | date and time |
| Expiry or next review | date |
| Evidence link | pull request, ticket or approval message |
Steps to make it routine
- Make the manifest the single place permissions live, so every change is a pull request.
- Require the pull request template to include the reason, ticket and expiry.
- Block merges without an approver who is not the author.
- Export the merged history on a schedule to a place your compliance team can read.
- Add removals to the record too. Auditors like to see access taken away.
- Sample five changes each quarter and check that each has all eight fields.
Common gaps
Verbal approvals with no record, approvals by the requester themselves, and records that say "added tool" without saying which scope. Another gap is silent changes: a server updates its tool list and the agent gains a tool nobody approved. Compare live tool lists with the manifest so that drift becomes a visible change.
Retention
Keep records as long as your retention schedule requires for access decisions, and ask your compliance lead what that is. This post does not give legal advice and no single period applies to everyone.
Safeguard offers MCP Guardrail and agent identity for applying this kind of policy to agent tool calls, and you can run a free scan of your own repositories at gold.safeguard.sh/scan. Autonomous fix pull requests are off by default, and every category starts on Manual.
Quick check
Is a chat message enough as approval evidence?
It is weak. Prefer a pull request approval or ticket decision that is timestamped and tied to a named person.
Should removals be recorded?
Yes. They show access is reviewed and not only added.
Sources
Last reviewed: 19 October 2026.
