Governance
Deciding what an agent may reach: roles, restrictions, frozen arguments, the audit trail afterwards, and what happens when somebody leaves.
MCP governance: who may do what, in which app
MCP governance decides who connects which app, which tools each role calls, whose account a call uses, what is logged and how access ends.
Uday Gajavalli
Vendor MCP servers: why run them through Elaichi
Vendor MCP servers bring the vendor's own tools. Through Elaichi they also get one address, per-person sign-in, tool rules and one audit log.
Uday Gajavalli
AI agents with employee permissions, no shared bot
How to run AI agents with employee permissions instead of one shared service account, and the cases where a named service identity is still correct.
Uday Gajavalli
Approved AI tools per team, set by role
Approved AI tools per team is two jobs: restrictions bound to a role for enforcement, and templates shared to a team for curation.
Uday Gajavalli
IT admin controls for MCP connectors, compared
What the IT admin controls for MCP connectors cover in Claude, ChatGPT and Cursor, and the three gaps none of those consoles closes.
Uday Gajavalli
Scheduled AI agent tasks, governed in advance
Scheduled AI agent tasks run with nobody present to approve, so the controls that count are set first: role restrictions, frozen arguments, a narrowed grant.
Uday Gajavalli
EU data residency for AI agents, leg by leg
EU data residency for AI agents spans three legs: the app, the control plane and the model. Elaichi's eu region pins the data store and tool calls to the EU.
Nachi Raman
Human approval for AI agent actions: the layers
Human approval for AI agent actions comes in layers: a prompt for the person asking, then the role rules, frozen values and requests an admin decides.
Roopendra Talekar
MCP security review checklist: ten questions
An MCP security review checklist: ten questions to ask before approving an MCP server or gateway, what a good answer looks like, and Elaichi's answers.
Uday Gajavalli
MCP security risks and how to reduce them
The MCP security risks a company faces, from prompt injection to keys in local configs, with an example and a fix for each, and who owns the fix.
Uday Gajavalli
How to roll out Claude and ChatGPT to employees
Roll out Claude and ChatGPT to employees in order: approve apps, connect them once, build team toolboxes, map roles, pilot, onboard and offboard.
Uday Gajavalli
Least privilege for AI agents without breakage
Least privilege for AI agents starts from what your pilot actually called: narrow to that recorded set, then confirm the rule landed before you trust it.
Raajshekhar Rajan
SOC 2 evidence for AI agents: CC6 and CC7
SOC 2 evidence for AI agents maps to CC6.1, CC6.2, CC6.3 and CC7.2: who can reach what, how access starts and ends, and a log of each executed tool call.
Roopendra Talekar
Why blocks match tool names but allows don't
In Elaichi, blocks match tool names or the operation behind them, while allows match the operation only, so a renamed tool can never widen a role's reach.
Uday Gajavalli
Lock AI agent tool arguments, like a wire's payee
Lock AI agent tool arguments with frozen parameters: Elaichi removes the field from the model's schema and writes your value over whatever the call sends.
Uday Gajavalli
Designing roles for AI agents: one role each
Design roles for AI agents as one complete job per person: Elaichi gives each member exactly one role and leaves which tools they reach to restrictions.
Raajshekhar Rajan
AI agents and PHI: four questions for your BAA
AI agents and PHI raise four BAA questions, all about access: minimum necessary, audit controls, workforce clearance and what happens when someone leaves.
Roopendra Talekar
What an AI agent audit log must capture
An AI agent audit log must capture who acted, which client called, which account was reached, what was tried and how it ended. Argument contents stay out.
Nachi Raman
Is Composio secure enough for enterprise use?
The answer to "is Composio secure enough for enterprise use" sits in architecture more than controls: its own pages list SSO, role permissions and call logs.
Nachi Raman
Restrict one AI tool or the whole app? Six cases
Restrict one AI tool when a role needs part of an app, and block the whole app when it needs none of it. Six cases, and what new tools do to each rule.
Roopendra Talekar
Offboarding AI access, contractors included
Offboarding AI access in Elaichi takes effect on the next call. Here is what the removal preflight checks, and the order that works.
Nachi Raman
Put agents to work on your own systems
14 days on Gold, no credit card. Start with one app and one team.
- Works with
-
and any other MCP client, or the Elaichi Agent.
- When the trial ends
- Nothing is deleted. Connections, roles and the audit log stay where they are, so subscribing picks up exactly where you left off.