Every agent action reaches your systems through Tier Two.
And on the way through it picks up a decision (Allow, Ask, or Block), the identity it runs as, and a row in the ledger.
Allow, Ask, or Block. Per tool.
No rule language. Every tool a connection offers gets one of three modes, and the whole connection can be set from one of three presets: Open, Recommended, or Locked. Recommended is applied when you add a connection: reads run, writes wait for a person.
Connections / Linear
Allow, Ask, or Block, per tool
Recommended is applied when you add a connection: reads run, writes wait for a person. Change any tool afterwards, or switch the whole connection to Open or Locked.
Reads and writes are guessed from each tool’s read-only hint and its name, and raw SQL counts as a write. It is a starting point, not a verdict: every tool is one click away from a different mode.
Connect your systems. Keep your credentials.
Add a system from the catalog or paste any MCP server URL. For each one, choose whether people sign in with their own account (so downstream permissions stay exactly theirs) or the workspace shares one provisioned key.
- PostHogOAuth · remote
- LinearOAuth · remote
- SentryOAuth · remote
- GitHubOAuth · remote
- NotionOAuth · remote
- AtlassianOAuth · remote
- StripeOAuth · remote
- CloudflareOAuth · remote
- SupabaseOAuth · remote
- NeonOAuth · remote
- FigmaOAuth · remote
- Metabaseself-hosted
Any MCP server. Paste a URL. A connection is any MCP server plus the mode you give each of its tools.
Your agent
Your agentsigned in as the person using it; no downstream key on the machine
Tier Two
Allow, Ask, or Block → the credential comes out of the sealed vault
Your system
receives the call with the person attached, and only if it was allowed
On a shared-key connection the call is forwarded server-side: the key is decrypted only for that call, used in process, and never reaches a device.
The sensitive call pauses instead of failing.
The call waits
An Ask does not fail the call. It pauses it, tells the agent a person is deciding, and completes the same call when the answer comes back.
Once, or always for that person
Approve once and only this call runs. Always remembers the decision for that person, on that tool. Any agent they sign in with inherits it, and you can revoke it later.
A denied call is told to stop, not to try something else, and the refusal is a row in the ledger like any other outcome.
Know every agent in your company.
Your workspace is the tenant
Members and admins map to your organization. Admins decide the modes; anyone with approval rights answers an Ask.
Agents act as a person
An agent's access is the access of the member who signed it in. Downstream, the call carries that person, not a shared service account.
Agents sign in, you revoke
Access is a token bound to one member and one client. Revoke it in the dashboard and the agent's next call fails. No key to rotate, no laptop to chase.
A directory, not a mystery
Every agent in one list: who it acts as, which host it connected from, when it was last seen, and what it has called.
Want the machine to count too? The optional Tier Two Client carries a device identity, so policy can require an org-managed device on the tools that warrant it: managed devices.
Follow every call from agent to outcome.
Filter by person, agent, connection, tool, or outcome. Every row says what happened and why: allowed by policy, approved once by someone, waiting on a person, or refused.
Activity / Calls
Every call, allowed or not
Selected call
metabase__execute_sql
Paused for a decision. The approver sees the person, the agent, the tool and its arguments, then picks Approve once or Always for that person, and the waiting call completes.
The call ledger
Every call, allowed or not, with the person, the agent, the connection, the tool, and the reason for the outcome. Refusals are rows, not missing rows.
The governance ledger
Every change to the rules themselves: mode changes, preset changes, credential rotations, revocations, each with the human who made it.
Both ledgers stream to your SIEM: HMAC-signed webhooks or Splunk HEC, three versioned streams, in order and at least once, minutes behind live.
Both sides of the rollout.
For security & platform teams
- One place to see, allow, and revoke everything agents can do.
- Three modes anyone can review, and a posture you can set per connection.
- An append-only record of every decision, including the refusals.
For the engineers whose agents do the work
- Sign in once; your agent works everywhere the org allows.
- No credentials to paste into config files. The endpoint carries them.
- When something needs a person, the call waits instead of failing.