# Pharaoh Agent Shield — Agent Governance SKU One-Pager

**Document date:** 6 November 2026  
**Product:** Pharaoh Agent Shield (`pharaoh-agent-shield`) — Deterministic Runtime Enforcement & Agent Governance Gateway for MCP  
**Live verification door:** `/demo` (and `/` landing door) on tenant `tenant-demo`

---

## 1. Executive Summary

Enterprise teams deploying Model Context Protocol (MCP) and tool-using AI agents face an immediate operational and regulatory gap: **observability traces record what an agent did after the side effect has already occurred, while prompt instructions cannot stop an agent from calling an unapproved, unauthenticated, or destructive tool.**

**Pharaoh Agent Shield** is a deterministic, sub-millisecond enforcement gateway that sits between AI agents and MCP tool servers. The **Agent Governance SKU** delivers four live, verifiable runtime controls demonstrated on the `tenant-demo` live door:

1. **Agent Register with a Named Owner per Agent** — Every agent in `shield_agents` is bound to a named accountable human owner (`owner_human_id`), purpose, model, environment, status, and approval threshold tier. Policies with `requireRegisteredAgentOwner: true` block calls from any agent lacking a registered human owner (`AGENT_OWNER_REQUIRED`) before the upstream server is contacted.
2. **Approval Thresholds that Hold Agent Actions for Human Sign-Off** — Deterministic per-agent risk-tier thresholds (`approval_threshold_tier`: `T0`–`T4`) and structured argument thresholds (`count-at-least`, `number-at-least`) hold consequential tool calls (`REQUIRE_APPROVAL`) in `shield_approvals`. Approvals are cryptographically bound to the exact `request_hash` (`tool + server + arguments`), single-use (`CONSUMED` on first execution), and time-bounded (`expires_at`).
3. **Exportable Action Log Reconstructing What Each Agent Did** — `reconstructActionLog()` and `exportActionLog()` (`json`, `ndjson`, `csv`) join `shield_agents`, `shield_sessions`, `shield_tool_calls`, `shield_approvals`, and the append-only SHA-256 hash-chained `shield_audit_events` table to reconstruct the complete chronological sequence of what each agent requested, what was redacted or transformed, who approved or rejected held actions, and what the upstream tool returned—backed by live `verifyAuditChain()` tamper detection.
4. **MCP Server Authentication & Liveness Check** — `assessServerHealth()` and `checkAllServersAuthAndLiveness()` inspect registered MCP servers (`shield_mcp_servers`) and probe HTTP endpoints to flag **unauthenticated** servers (`UNAUTHENTICATED` — e.g. HTTP endpoints accepting calls without credentials or leaking embedded URL credentials) and **dead** servers (`DEAD` — unreachable, refused, or non-responsive transport), raising operator alerts (`MCP_SERVER_UNAUTHENTICATED`, `MCP_SERVER_DEAD`) and audit events (`inventory.server.health_checked`).

---

## 2. Four Live Controls Mapped to UK ICO Expectations & EU AI Act Article 50 Duties

Every regulatory mapping below cites the specific dated instrument and claims **only capabilities that are live and verified in this repository**.

### A. UK Information Commissioner's Office (ICO) Expectations

* **Primary Dated Citations:**
  * **ICO *Tech Futures: Agentic AI* report** (published **8 January 2026**), examining data protection risks of autonomous, multi-step tool-calling AI systems, controller/processor responsibility chains, and human oversight failure modes.
  * **ICO Call for Evidence on Agentic AI** (open regulatory consultation closing **18 November 2026**), seeking technical evidence on accountability, human-in-the-loop thresholds, reconstructability of autonomous chains, and third-party tool security.
  * **UK GDPR & Data Protection Act 2018:** **Article 5(1)(a)** (lawfulness, fairness, and transparency), **Article 5(2)** (controller accountability), **Article 22** (automated decision-making and meaningful human intervention), **Article 25** (data protection by design and by default), and **Article 32** (security of processing).

| Live Agent Shield Control | UK ICO Expectation & UK GDPR Duty Addressed | What Is Live & Verified in `pharaoh-agent-shield` |
| :--- | :--- | :--- |
| **1. Agent Register with Named Owner per Agent** | **UK GDPR Art. 5(2) Accountability & ICO *Tech Futures: Agentic AI* (8 Jan 2026) on clear human responsibility:** organisations deploying autonomous agents must designate a named accountable owner per agent rather than treating autonomous execution as unowned. | `registerAgent()` requires a non-empty `ownerHumanId`, stores `purpose`, `model`, `environment`, `status`, and `approval_threshold_tier` in `shield_agents`, records `governance.agent.registered` in the hash-chained audit log, and blocks unowned agents when `requireRegisteredAgentOwner` is enabled (`AGENT_OWNER_REQUIRED`). |
| **2. Approval Thresholds Holding Actions for Human Sign-Off** | **UK GDPR Art. 22 & ICO *Tech Futures: Agentic AI* (8 Jan 2026) on meaningful human review:** human-in-the-loop sign-off must occur *before* irreversible or high-impact external side effects and must present the reviewer with the exact data classes and destination. | Per-agent `approval_threshold_tier` (`T0`–`T4`) and policy matchers (`count-at-least`, `number-at-least`) hold calls in `REQUIRE_APPROVAL`. Queue entries show classified data (`PERSONAL_DATA`, `CUSTOMER_DATA`, `FINANCIAL_DATA`, `HEALTH_DATA`), target destination, and secret-redacted arguments. Approvals bind to `request_hash` and cannot be replayed on altered arguments (`APPROVAL_MISMATCH`). |
| **3. Exportable Reconstructable Action Log** | **UK GDPR Art. 5(1)(a), Art. 5(2) & Art. 30 / ICO audit reconstructability expectations (8 Jan 2026):** controllers must be able to reconstruct multi-step agent actions end-to-end for data subject inquiries, regulator audits, and incident investigations without logging raw secrets. | `reconstructActionLog()` and `/demo/export/action-log?format=json\|ndjson\|csv` reconstruct every agent's chronological tool calls, correlation IDs, redactions, transformations, approval decisions, and SHA-256 audit chain links, verified live by `verifyAuditChain()`. |
| **4. MCP Server Auth & Liveness Check** | **UK GDPR Art. 25 & Art. 32 (Security of processing) & ICO *Tech Futures: Agentic AI* (8 Jan 2026) on third-party tool supply-chain security:** controllers must prevent agents from sending personal or confidential data to unauthenticated, shadow, or dead MCP tool endpoints. | `assessAllServers()` and `checkAllServersAuthAndLiveness()` verify server authentication posture and endpoint liveness, flagging `UNAUTHENTICATED` and `DEAD` MCP servers, recording `MCP_SERVER_UNAUTHENTICATED` / `MCP_SERVER_DEAD` alerts, and enforcing `DISCOVERED`/`QUARANTINED` server blocks at runtime. |

### B. European Union Artificial Intelligence Act — Regulation (EU) 2024/1689

* **Primary Dated Citations:**
  * **Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024** laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), **published in the Official Journal of the European Union (`OJ L, 2024/1689`) on 12 July 2024**, **entered into force on 1 August 2024**, with **Article 50 (Transparency obligations for providers and deployers of certain AI systems) applicable from 2 August 2026**.
  * **Supporting governance provisions:** **Article 12** (Record-keeping / automatic logging over system lifetime) and **Article 14** (Human oversight measures preventing over-reliance and enabling immediate system interruption).

| Live Agent Shield Control | EU AI Act Duty (Regulation (EU) 2024/1689, OJ L 12 Jul 2024; Art. 50 applicable 2 Aug 2026) | What Is Live & Verified in `pharaoh-agent-shield` |
| :--- | :--- | :--- |
| **1. Agent Register with Named Owner per Agent** | **Article 50(1) (AI interaction identity & attribution, applicable 2 Aug 2026) & Article 14 (Human oversight assignment):** deployers must ensure AI systems interacting with natural persons or external services have explicit AI system identity (`agent_id`, `model`, `autonomous` flag) attributed to a natural person overseeing the agent (`owner_human_id`). | Every agent call carries structured actor provenance (`agentId`, `humanId`, `autonomous`, `model`, `sessionId`) linked to its registered human owner in `shield_agents`, with server-side pause (`PAUSED`) and kill-switch controls (`KILL_SWITCH_ACTIVE`). |
| **2. Approval Thresholds Holding Actions for Human Sign-Off** | **Article 50(1) & Article 50(4) (Deployer control over external AI communications, applicable 2 Aug 2026) & Article 14(4)(d)-(e) (Ability to intervene or halt execution):** outbound communications (`send_email`, `external_post`) and high-tier actions (`T2`–`T4`) can be held for human verification and disclosure checks prior to execution. | Setting an agent's `approval_threshold_tier` to `T2` holds external communications (`external_post`, `send_email`) for human sign-off before anything is transmitted externally; numeric/array thresholds (`count-at-least: 20`) hold bulk recipient sends automatically. |
| **3. Exportable Reconstructable Action Log** | **Article 50(2) (Technical provenance & traceability of AI-assisted actions, applicable 2 Aug 2026) & Article 12 (Automatic event logging):** providers and deployers must maintain machine-readable provenance and tamper-evident logs of AI system operations. | Exportable JSON, NDJSON, and CSV action logs record `request_hash`, `forwarded_hash`, `response_hash`, `correlation_id`, policy latency, redactions, transformations, and SHA-256 hash-chained audit sequence numbers (`seq`, `prev_hash`, `hash`). |
| **4. MCP Server Auth & Liveness Check** | **Article 14(4)(a) & Article 15 (Operational robustness, cybersecurity, and tool boundary integrity):** AI systems connected to external tools must verify that connected tool servers are authenticated, alive, and free of unreviewed schema drift. | Continuous and on-demand MCP server health checks flag `UNAUTHENTICATED` and `DEAD` endpoints; tool SHA-256 fingerprinting (`fingerprintTool`) revokes approval (`DRIFT_DETECTED`) and quarantines `T3`/`T4` servers when tool schemas or descriptions mutate. |

---

## 3. Honest Capability Boundary — Only What Is Live Today

In accordance with Pharoah Technology's engineering and compliance standards, this document claims **only controls that are implemented, tested, and running in `pharaoh-agent-shield` today**:

* **Live & Verified Today:**
  * Deterministic policy evaluation engine (`< 1 ms` average latency, zero LLM calls in the critical path).
  * Official `@modelcontextprotocol/sdk` gateway over `stdio` and `streamable-http` upstreams.
  * Agent register with mandatory human owner (`owner_human_id`) and per-agent approval threshold (`approval_threshold_tier`).
  * Single-use, `request_hash`-bound human approvals (`ApprovalService`).
  * Secret detection (21 structured, contextual, and Shannon-entropy detectors) and PII / payment-card (Luhn) / health / customer data classification with verified pre-forward redaction and SQL/row-limit transformations.
  * Exportable reconstructable action logs (`json`, `ndjson`, `csv`) backed by a SQLite trigger-protected, SHA-256 hash-chained audit log (`verifyAuditChain()`).
  * MCP server authentication & liveness checker flagging `UNAUTHENTICATED` and `DEAD` servers.
* **Not Claimed / Phase 2 Scope:**
  * **Upstream OAuth Credential Broker (Phase 2):** Agent Shield detects and blocks credential egress today, and stores no plaintext secrets, but minting short-lived per-call upstream OAuth tokens is Phase 2 and is not claimed as live.
  * **Multimedia Pixel/Audio Watermarking under EU AI Act Art. 50(2):** Agent Shield provides cryptographic SHA-256 provenance and reconstructable logs for **agent tool actions**, not C2PA pixel/audio watermarking for synthetic media generators.
  * **Commercial Pricing:** Commercial tier pricing is currently under owner review and is intentionally withheld from public publication until owner approval is granted.