Stage 1: inventory
Find every agent, MCP server, extension and AI tool on your devices, and what each can reach. Most teams find more than they expected: agents installed by individuals, MCP servers added for a single project, extensions nobody approved. Vendors put inventory first for this reason. Prompt Security describes discovering shadow MCP servers and unsanctioned agent deployments. Noma Security describes discovering endpoint agents with the MCP servers and skills each uses. Bay's homepage cites posture alerts within minutes of deployment, a vendor-stated figure.
Output of this stage: a list of agents and MCP servers by team, and the obvious problems, such as credentials exposed to agents or servers with broad permissions.
Stage 2: observe
Turn on activity recording without blocking anything. Record which actions agents take, who started each session and whether a person approved each step. Two to four weeks is usually enough to see normal patterns per team. This is also where the actor trail proves its value: you need to tell what a person did from what an agent did on their behalf.
Output: a short list of the risky actions that actually happen, with the teams and agents involved.
Stage 3: simulate
Write rules for the risky actions from stage 2, using the capability rules in lesson 9, and run them in simulation. Review would-be blocks with the affected teams. Tune exceptions until the would-be false positives are rare enough that people will accept them.
Output: a rule set each team has seen, with known exceptions.
Stage 4: enforce
Turn on enforcement for the riskiest capabilities first: credential reads, destructive commands, changes to cloud infrastructure, unknown MCP servers. Prefer ask and warn verdicts where a block would stop real work. Keep simulation running for the next batch of rules.
Output: enforced rules with a review date, and a route for people to request exceptions.
What to measure between stages
- Coverage: the share of devices and agents where the product is active.
- Would-be blocks per team per week, in simulation.
- Time to answer an exception request.
- Actions decided before execution, as a share of risky actions observed.
Why staged rollouts last
Controls that arrive overnight get switched off after the first bad week. Controls that arrive in stages, with the people affected seeing the rules first, become part of how agents are used. That is the point of the category: letting people use agents widely because the company can say what they are allowed to do. The OWASP GenAI Security Project's 2026 work on Excessive Agency and its Agent Control Standard point the same way: limit what agents can do, and enforce it at runtime.