Pharaoh Agent Shield — Agent Governance SKU (Live Demo Door)

Deterministic runtime enforcement between AI agents and Model Context Protocol (MCP) tool servers. Evaluated synchronously in sub-millisecond latency with zero LLM calls in the critical path. Demonstrating live state on isolated tenant tenant-demo (ENFORCE mode).

Read Governance One-Pager One-Pager (.md) Export Action Log (JSON) Export Action Log (NDJSON) Export Action Log (CSV) Live Demo JSON API Draft ICO Call for Evidence Response

3

registered agents with named owners

3

actions held for human sign-off

7

reconstructable agent actions

3

flagged MCP servers (unauth / dead)

VERIFIED

SHA-256 audit hash chain

Regulatory Alignment — UK ICO Expectations & EU AI Act Article 50 Duties

This landing section maps the four live controls below to dated UK and EU regulatory obligations, claiming only capabilities that are live and verified in this codebase today. Commercial tier pricing is withheld pending owner approval.

Live Control on Demo Tenant	UK ICO Expectations (Dated Citations)	EU AI Act Article 50 & Governance Duties (Dated Citations)	Live Verification Boundary
1. Agent Register with Named Owner per Agent shield_agents.owner_human_id	*ICO Tech Futures: Agentic AI* (published 8 January 2026) & ICO Call for Evidence on Agentic AI (closing 18 November 2026); UK GDPR Art. 5(2)** (controller accountability): requires clear human accountability for autonomous agent actions.	Regulation (EU) 2024/1689 (EU AI Act), published OJ L 12 July 2024, entered into force 1 August 2024, Article 50(1) (applicable 2 August 2026) & Article 14: attributes agent actions to a disclosed AI agent identity and named human owner.	Live in registerAgent() and requireRegisteredAgentOwner policy invariant (AGENT_OWNER_REQUIRED).
2. Approval Thresholds Holding Actions for Human Sign-Off approval_threshold_tier + argMatches	*ICO Tech Futures: Agentic AI* (8 January 2026) on meaningful human review & UK GDPR Art. 22*: human sign-off must occur before* high-impact external side effects and bind to the exact action and data classes.	EU AI Act Regulation (EU) 2024/1689 (OJ L 12 July 2024), Article 50(1) & 50(4) (applicable 2 August 2026) & Article 14(4)(d)-(e): holds outbound communications (send_email, external_post) and high-tier actions for human sign-off.	Live per-agent tier thresholds (T0–T4), numeric/count thresholds (count-at-least, number-at-least), and single-use request_hash binding.
3. Exportable Action Log Reconstructing What Each Agent Did reconstructActionLog + exportActionLog	*ICO Tech Futures: Agentic AI* (8 January 2026) on post-hoc reconstructability & UK GDPR Art. 5(1)(a), Art. 5(2), Art. 30**: controllers must reconstruct multi-step agent tool chains without logging raw secrets.	EU AI Act Regulation (EU) 2024/1689 (OJ L 12 July 2024), Article 50(2) (machine-readable provenance at the action layer, applicable 2 August 2026) & Article 12 (automatic record-keeping).	Live JSON, NDJSON, and CSV exports with SHA-256 request/forwarded/response hashes and verifyAuditChain() replay. (Multimedia pixel watermarking is out of scope and not claimed.)
4. MCP Server Auth & Liveness Check assessAllServers + checkAllServersAuthAndLiveness	*ICO Tech Futures: Agentic AI* (8 January 2026) on third-party tool supply chains & UK GDPR Art. 25 & Art. 32** (security of processing): flags unauthenticated or dead MCP servers before data egress.	EU AI Act Regulation (EU) 2024/1689 (OJ L 12 July 2024), Article 14(4)(a) & Article 15 (cybersecurity and operational resilience of connected tool endpoints).	Live check flags UNAUTHENTICATED and DEAD MCP servers and raises operator alerts. (Phase 2 upstream OAuth token broker is not claimed.)

Interactive Control Simulator — Test Approval Thresholds & Owner Enforcement Live

Trigger a live tool call through Shield.enforce() on tenant-demo. Calls at or above the agent's approval threshold (or with 20+ email recipients / 500+ refund units) are held in REQUIRE_APPROVAL; calls from an unowned agent are blocked with AGENT_OWNER_REQUIRED.

Deterministic Policy Preview: agent-customer-triage (owner: sarah.chen@acme-demo.invalid, threshold: T2) → send_email (25 recipients, 750 units) → REQUIRE_APPROVAL — Bulk email recipient count (25 >= 20) held for human sign-off by sarah.chen@acme-demo.invalid [rule: bulk-email-approval-threshold]

Control 1 — Agent Register with a Named Owner per Agent

Every registered agent in shield_agents has a named accountable human owner (owner_human_id) and a per-agent approval threshold tier (approval_threshold_tier). Policy invariant requireRegisteredAgentOwner: true refuses calls from any agent without a named human owner (AGENT_OWNER_REQUIRED).

Agent	Named Human Owner	Approval Threshold	Model	Env	Status	Recorded Activity
Automated GDPR & AI Act Audit Agent agent-compliance-auditor	✓elena.rossi@acme-demo.invalid	T3	gemini-3.1-pro	production	✓ACTIVE	1 calls (1 held) · 1 sessions
Customer Support Triage Agent agent-customer-triage	✓sarah.chen@acme-demo.invalid	T2	claude-sonnet-4-6	production	✓ACTIVE	3 calls (1 held) · 1 sessions
Treasury & Billing Operations Agent agent-treasury-ops	✓marcus.vance@acme-demo.invalid	T2	gpt-5.4	production	✓ACTIVE	3 calls (2 held) · 1 sessions

Control 2 — Approval Thresholds Holding Agent Actions for Human Sign-Off

Actions meeting or exceeding an agent's approval_threshold_tier or a policy argument threshold (count-at-least, number-at-least) are held in REQUIRE_APPROVAL. Approvals are cryptographically bound to request_hash and consumed on first use.

Requested	Agent	Named Owner	Tool	Tier	Threshold / Policy Reason	Redacted Args	Status	Human Sign-Off
00:42:32	agent-treasury-ops	marcus.vance@acme-demo.invalid	issue_refund	T3	Refund amount is at or above the 500 unit threshold; held for human sign-off. [rule high-value-refund-approval-threshold]	{"customerId":"cust-8841","amountUnits":1250}	⏸PENDING
00:42:32	agent-compliance-auditor	elena.rossi@acme-demo.invalid	delete_customer	T4	Agent "Automated GDPR & AI Act Audit Agent" approval threshold (T3) holds T4 tool "delete_customer" for human sign-off by owner elena.rossi@acme-demo.invalid.	{"customerId":"cust-closed-2019"}	⏸PENDING
00:42:32	agent-treasury-ops	marcus.vance@acme-demo.invalid	external_post	T2	Agent "Treasury & Billing Operations Agent" approval threshold (T2) holds T2 tool "external_post" for human sign-off by owner marcus.vance@acme-demo.invalid.	{"channel":"status-webhook","message":"Scheduled settlement maintenance window 22:00 UTC."}	✓CONSUMED	marcus.vance@acme-demo.invalid
00:42:32	agent-customer-triage	sarah.chen@acme-demo.invalid	send_email	T2	Bulk send to 20 or more recipients requires human approval. [rule approval-for-bulk-recipients]	{"recipients":["stakeholder1@acme-demo.invalid","stakeholder2@acme-demo.invalid","stakeholder3@a	⏸PENDING

Control 3 — Exportable Action Log Reconstructing What Each Agent Did

Chronological reconstruction across shield_agents, shield_sessions, shield_tool_calls, shield_approvals, and the append-only SHA-256 hash-chained shield_audit_events table.

✓ Audit Chain Integrity: VERIFIED — 48 events verified | Download JSON · Download NDJSON · Download CSV

Time	Agent / Owner	Correlation ID	Tool	Tier	Decision	Reasons	Request Hash	Approval Sign-Off	Audit Seq
00:42:32	agent-customer-triage sarah.chen@acme-demo.invalid	corr-triage-ticket-402	read_customer	T0	✓±ALLOW_WITH_MODIFICATION	ARGUMENT_TRANSFORMED, POLICY_ALLOW	622fcf56b4ef	—	#33, #34
00:42:32	agent-customer-triage sarah.chen@acme-demo.invalid	corr-triage-ticket-402	create_note	T1	✓ALLOW	POLICY_ALLOW	58b32d5efc87	—	#35, #36
00:42:32	agent-customer-triage sarah.chen@acme-demo.invalid	corr-triage-ticket-402	send_email	T2	⏸REQUIRE_APPROVAL	TIER_REQUIRES_APPROVAL	51c106db8dc8	PENDING	#37, #38
00:42:32	agent-treasury-ops marcus.vance@acme-demo.invalid	corr-treasury-settlement-108	external_post	T2	⏸REQUIRE_APPROVAL	TIER_REQUIRES_APPROVAL	4fc5ca462ee3	CONSUMED (marcus.vance@acme-demo.invalid)	#39, #40, #41, #42, #43
00:42:32	agent-treasury-ops marcus.vance@acme-demo.invalid	corr-treasury-settlement-108	external_post	T2	✓ALLOW	TIER_REQUIRES_APPROVAL, APPROVAL_GRANTED	4fc5ca462ee3	—	#40, #43, #44
00:42:32	agent-treasury-ops marcus.vance@acme-demo.invalid	corr-treasury-refund-519	issue_refund	T3	⏸REQUIRE_APPROVAL	TIER_REQUIRES_APPROVAL	83476518f7ba	PENDING	#45, #46
00:42:32	agent-compliance-auditor elena.rossi@acme-demo.invalid	corr-gdpr-erasure-304	delete_customer	T4	⏸REQUIRE_APPROVAL	TIER_REQUIRES_APPROVAL	83d1dd20694d	PENDING	#47, #48

Control 4 — MCP Server Authentication & Liveness Check

Verifies MCP server authentication posture and liveness, flagging UNAUTHENTICATED endpoints (missing auth headers or credentials leaked in URL queries) and DEAD endpoints (unreachable or refused connections).

Total: 4 · Healthy: 1 · Unauthenticated: 2 · Dead: 2

MCP Server	Transport	Inventory Trust	Auth State	Liveness	Health Verdict	Diagnostic Detail
crm-core stdio://crm-mcp-server --tenant acme	stdio	✓APPROVED	✓AUTHENTICATED	✓ALIVE	✓HEALTHY	Authenticated and alive.
legacy-billing-http https://billing-mcp.internal.acme-demo.invalid/mcp	streamable-http	◐RESTRICTED	⚠UNAUTHENTICATED	✓ALIVE	⚠FLAGGED (UNAUTHENTICATED)	Flagged: HTTP MCP endpoint responded 200 OK to unauthenticated JSON-RPC probe without Authorization or X-API-Key header.
orphaned-erp-bridge https://erp-bridge.decommissioned.acme-demo.invalid/mcp	streamable-http	⛔QUARANTINED	✓AUTHENTICATED	✕DEAD	⚠FLAGGED (DEAD)	Flagged: Liveness probe failed (ECONNREFUSED / upstream dead).
shadow-analytics-open http://127.0.0.1:59999/mcp?api_key=embedded_query_token	streamable-http	?DISCOVERED	⚠UNAUTHENTICATED	✕DEAD	⚠FLAGGED (UNAUTHENTICATED, DEAD)	Credentials or tokens are embedded in the server URI rather than an authenticated header/broker. Credentials or tokens are embedded in the server URI rather than an authenticated header/broker. Flagged: Unauthenticated URL query credential pattern and dead loopback endpoint on port 59999.