Founding Legal Counsel

Deeploy launches MCP Server for enhanced AI agent governance and control. Deeploy, a leading platform for secure and governed AI deployments, has launched a new MCP Server specifically built to address the growing governance and control challenges of agentic AI systems. The Model Context Protocol (MCP) Server enables organizations to better manage how AI agents discover tools, interact with systems, and maintain consistent behavior across complex workflows. As enterprises increasingly move from simple copilots to autonomous agents capable of planning, reasoning, and taking actions, the need for standardized, secure, and observable communication between agents and tools has become critical. Deeploy's new offering focuses on providing centralized governance over agent-tool interactions, improved visibility into agent behavior, and stronger runtime controls. This is particularly relevant as organizations face rising concerns around agent sprawl, unauthorized actions, data exfiltration risks, and maintaining human accountability in multi-agent environments. The launch reflects a broader industry shift toward building dedicated infrastructure layers for agentic AI governance. Rather than treating agents as isolated applications, Deeploy is positioning the MCP Server as a control plane that helps enforce policies, monitor interactions, and maintain auditability across the entire agent ecosystem. Key terms. * MCP Server (Model Context Protocol Server): A dedicated server that standardizes and governs how AI agents discover, authenticate, and interact with tools and external systems in a secure, observable manner. * Agentic AI: Autonomous AI systems that can plan, reason, use tools, and execute multi-step tasks with minimal human intervention. * Runtime Governance: Continuous oversight and control mechanisms that operate while agents are active, rather than only during pre-deployment reviews. * Agent-Tool Interaction: The process by which AI agents call and use external tools, APIs, or systems to complete tasks. * Policy Enforcement Layer: Technical controls that ensure agents only perform actions that comply with predefined organizational policies and boundaries. These terms reflect the growing need for dedicated infrastructure to manage the complexity and risk of deploying autonomous agents at enterprise scale. Conditions driving this change. * Enterprises are rapidly moving beyond simple chat-based copilots to deploying autonomous AI agents capable of planning, reasoning, and executing complex, multi-step workflows across internal systems and external tools, dramatically increasing both capability and risk. * The rise of multi-agent systems has created new challenges around visibility, as agents interact with each other and with hundreds of tools, making it difficult for traditional governance approaches to maintain effective oversight and control. * Organizations are struggling with agent sprawl - the uncontrolled proliferation of agents - leading to unclear ownership, inconsistent policy application, and growing security and compliance exposure. * Current methods of agent governance, often limited to prompt-level guardrails or basic API access controls, have proven insufficient against sophisticated attacks such as prompt injection, tool misuse, and unauthorized data exfiltration. * Procurement and security teams are demanding standardized, secure protocols for agent-tool communication, as the lack of common standards has resulted in fragmented, insecure, and difficult-to-audit implementations across different vendors and platforms. * Regulatory and board-level expectations around AI accountability are rising, requiring organizations to demonstrate clear visibility, policy enforcement, and auditability over agent behavior in production environments. * The industry is seeing increased adoption of the Model Context Protocol (MCP) as a emerging standard for secure agent-tool interactions, creating demand for robust, enterprise-grade MCP Server infrastructure that can enforce governance policies at scale. * Companies need better runtime observability and intervention capabilities as agents become more autonomous, because relying solely on pre-deployment testing or post-incident reviews is no longer adequate for high-stakes operational use cases. What it looked like before. Before dedicated MCP Servers and standardized agent communication protocols, organizations managing AI agents faced significant governance and security challenges. Most companies relied on ad-hoc approaches - typically basic API keys, prompt-level guardrails, or simple allow/deny lists for tool access. These methods provided minimal visibility into how agents actually interacted with tools and external systems. Security teams often struggled with fragmented implementations. Different agents used different authentication methods, logging was inconsistent, and there was little centralized policy enforcement. When an agent needed to call multiple tools, developers would hardcode connections or use custom scripts, making it extremely difficult to audit behavior or enforce consistent rules across the environment. Runtime oversight was particularly weak. Once an agent was deployed, monitoring its tool usage in real time was limited. Teams had little ability to detect anomalous behavior, unauthorized tool calls, or policy violations as they happened. This created blind spots around data exfiltration risks, privilege escalation, and unintended actions - especially problematic in multi-agent setups where agents could call other agents or chain multiple tools together. Governance was largely static and pre-deployment focused. Organizations would review agent designs during approval stages but had limited ongoing control once agents were live. This gap between design intent and actual runtime behavior became a major Pre-Failure Signal as agentic AI scaled. What it looks like now. With Deeploy's MCP Server, organizations now have a dedicated, centralized layer for governing agent-tool interactions. The server standardizes how agents discover, authenticate, and communicate with tools while enforcing organizational policies in real time. Instead of fragmented, custom integrations, teams can now manage agent-tool access through a unified control plane. Policies can be defined centrally and applied consistently across all agents, with fine-grained controls over which tools each agent can access and under what conditions. The server provides improved visibility into agent behavior, logging interactions, and enabling real-time monitoring and intervention when needed. This represents a shift toward true runtime governance. Security and governance teams can now observe agent activity as it happens, detect anomalies, enforce boundaries, and maintain audit trails that are much more comprehensive than before. For multi-agent systems, the MCP Server helps manage complex interactions while maintaining clear accountability and policy compliance. The overall approach moves from reactive, manual oversight to proactive, architectural control. Organizations can define clear boundaries for agent autonomy, enforce least-privilege principles more effectively, and maintain better control as they scale agent deployments across the enterprise. Its Take. AI Governance Take Deeploy's launch of the MCP Server represents a meaningful step forward in addressing one of the most pressing challenges in the agentic era: how to create standardized, enforceable governance over how AI agents interact with tools and external systems. By providing a dedicated control plane for agent-tool communication, the solution helps organizations move beyond fragmented, custom implementations toward centralized policy enforcement, better visibility, and stronger runtime controls. This is particularly important as enterprises scale from single agents to complex multi-agent workflows. The real value lies in shifting governance from being mostly pre-deployment and prompt-based to something more architectural and continuous. Features like standardized authentication, policy enforcement at the interaction layer, and improved auditability directly support better human accountability and risk management. For governance, compliance, and security teams, solutions like this highlight the growing need for dedicated infrastructure layers specifically designed for agentic AI. While no single tool solves every problem, centralized MCP Servers are becoming an important building block for maintaining control as autonomous agents become more common in enterprise environments. Follow GetAIGovernance on LinkedIn

Apply NIST AI RMF & AIUC-1 to your AI use cases. February 9, 2026 AI governance standards like the NIST AI Risk Management Framework and the AIUC-1 certification provide critical guidance for building trustworthy AI systems, but translating their requirements into operational practice can be a challenge. Organizations need a way to move from principles to concrete controls that can be consistently applied and validated across AI use cases. That's why Deeploy has added two new control frameworks to Deeploy: NIST AI Risk Management Framework and AIUC-1. These pre-configured frameworks map each standard's requirements directly to actionable controls that you can apply to your AI use cases in one click. What is the AIUC-1 standard and certificate? The AIUC-1 is the world's first certification standard for AI agents. Developed by the AI Use Case Certification body, it provides requirements across six critical risk categories: * Security - Preventing unauthorized access to AI systems through adversarial testing, access controls, monitoring, and safeguards against prompt injection and jailbreak attempts. * Safety - Keeping customers safe by mitigating harmful AI outputs and protecting brand reputation through rigorous 3rd-party testing, monitoring, and safeguards including human-review of flagged outputs. * Reliability - Preventing unreliable AI outputs that cause customer harm through testing against hallucinations and unauthorized tool calls, and implementing safeguards to detect and prevent these concerns. * Accountability - Enforcing strong governance and oversight through formal approval processes, AI failure plans, vendor due diligence, and oversight mechanisms with explicitly defined ownership. * Society - Preventing AI from enabling catastrophic societal harm through guardrails against cyber exploitation, system misuse, and threats to national security including chemical, biological, and nuclear risks. * Data & Privacy - Protecting users and enterprises against data & privacy concerns through customer data policies, access controls, and safeguards against data leakage, IP exposure, and unauthorized training on user information. Like ISO 27001 and FedRAMP, AIUC-1 certification requires ongoing technical testing and compliance verification, with annual renewal to remain current. Learn more about AIUC-1 at aiuc.org. How can Deeploy help you achive the AIUC-1 certification? Deeploy offers pre-configured control frameworks mapped to the most relevant AI Governance standards. A control framework is a structured sets of controls that translate AI governance policies and regulations into actionable requirements for teams to implement. They allow organizations to implement, enforce, and track AI controls consistently across multiple AI systems and use cases. Controls can be verified through automated checks or they may require evidence to be uploaded manually. How it works in practice: Its AIUC-1 control framework maps all certification requirements to controls you can apply to your AI use cases. * Apply the framework - Select AIUC-1 and apply it to a workspace. All AI use cases in that workspace automatically inherit the relevant controls. * Deeploy auto determines what applies - Each AI use case gets the controls that match its lifecycle stage (development, production, etc.) * Teams complete controls -Teams can then upload evidence (Documents, text, images) to show that a control has been met and mark that control as completed. * Governance reviews progress - Compliance and governance teams can see which controls are completed, in progress, or pending across all use cases. Automated checks available for the AIUC-1 control framework: Many controls include automated checks that verify compliance without manual work. When a check passes, Deeploy automatically updates the control status. For example, in the AIUC-1 standard, automated checks verify if: * Guardrails are applied to prevent harmful inputs or outputs. * Model & data cards are available for models. * Events are automatically recorded. * An alert rule is set for the metric disagreement ratio (measures real-time user feedback on model decisions). What is the NIST AI Risk Management Framework? The NIST AI Risk Management Framework (AI RMF) is a voluntary standard developed by the U.S. National Institute of Standards and Technology. It provides guidance for incorporating trustworthiness into the design, development, use, and evaluation of AI systems through four core functions: * Govern - Cultivating a culture of risk management with clear policies, roles, and accountability structures. * Map - Understanding the context of AI use, including business goals, stakeholders, risks, and societal impacts. * Measure - Assessing AI systems using metrics and testing to evaluate trustworthiness characteristics like fairness, transparency, and reliability. * Manage - Implementing controls to mitigate identified risks and ensuring ongoing monitoring and improvement. How does Deeploy help you implement the NIST AI RMF? Its NIST AI RMF control framework maps all certification requirements to controls you can apply to your AI use cases. * Apply the framework - Select NIST AI RMF and apply it to a workspace. All AI use cases in that workspace automatically inherit the relevant controls. * Deeploy auto determines what applies - Each AI use case gets the controls that match its lifecycle stage (development, production, etc.) * Teams complete controls -Teams can then upload evidence (Documents, text, images) to show that a control has been met and mark that control as completed. * Governance reviews progress - Compliance and governance teams can see which controls are completed, in progress, or pending across all use cases. Automated checks available for the NIST AI Risk Management Framework: Many controls include automated checks that verify compliance without manual work. When a check passes, Deeploy automatically updates the control status. For example, in the NIST AI Risk Management Framework, automated checks verify if: * Use cases are subject to a periodic reviews. * Required documentation has been completed. * A model card and deployment description are available * Predictions are being explained regularly. * Evaluations are submitted regularly. * Alert rules are set for model errors, performance metrics, response time, traffic, and disagreement ratio. * Required parameters are defined in metadata. Apply standards directly to your AI use cases. Deeploy's control frameworks transform external standards into operational governance. With its NIST AI RMF and AIUC-1 frameworks, you can: * Apply standards in one click - Select a framework and apply it to workspaces, instantly implementing all mapped controls across your AI use cases. * Automate compliance validation - Use built-in checks to verify that controls are met, collecting structured evidence as teams work. * Accelerate certification - Streamline audit preparation with centralized compliance tracking and ready-to-use frameworks and documentation templates. * Maintain ongoing compliance - Leverage automated checks and scheduled use case reviews to ensure AI systems remain aligned with standards over time. By translating NIST and AIUC-1 requirements into actionable Deeploy controls, you move beyond static policy documents and achieve verifiable governance at scale. Get started with control frameworks. Ready to implement NIST AI RMF or AIUC-1 standards across your AI systems? Frequently asked questions. What's the difference between the NIST AI RMF and AIUC-1 frameworks? NIST AI RMF is a broad risk management framework applicable to all AI systems, focusing on governance, risk mapping, measurement, and management. AIUC-1 is a certification standard specifically for AI agents, with detailed requirements across security, safety, reliability, accountability, societal risks, and data privacy. NIST provides the overall governance structure, while AIUC-1 offers agent-specific compliance criteria. Who can certify organizations against AIUC-1? Is AIUC-1 certification required? Is NIST AI RMF certification required? Who verifies NIST AI RMF implementation? Can I apply these frameworks to AI systems already in production in Deeploy? Does applying a control framework in Deeploy automatically make me compliant?