AI use policy
How XOOZLY governs the AI agents running in your workspace.
Scoped actions
Every agent action — reading a file, calling an API, opening a pull request — is checked against the MCP Gateway policy attached to its project before it runs. An agent can only reach the tools and scopes you've explicitly granted its connections; there is no path for an agent to act outside that boundary.
Human approval on high-risk actions
Actions flagged as high-risk (irreversible changes, production deploys, anything touching customer data) require your explicit approval before they take effect. Approval requests appear in your queue with the full context of what's being asked and why.
Cost caps are hard limits
Every project has a cost cap you set. Agent runs are checked against it before they start, and a run that would breach the cap is paused rather than allowed to continue spending. There is no way for an agent to exceed the budget you've configured.
Full audit trail
Every action an agent takes — and every governance decision the MCP Gateway makes about it — is written to an append-only audit log, available to you at any time. Nothing an agent does happens without a record you can review.