> ## Documentation Index > Fetch the complete documentation index at: https://docs.nuwacom.ai/llms.txt > Use this file to discover all available pages before exploring further. # Governance ## Overview The Governance module gives administrators a central view of Agents, Skills, and Connectors in the workspace settings. It supports access and sharing management, reviews of published Agents, and the identification of potential security risks. The module is enabled by default under *Settings → Modules* and can be disabled when Governance access is not required. > [!NOTE] > > Governance is free until 1 January 2027. After that, Governance add-on pricing will apply. Details will be announced soon. ## Governance Overview The Governance overview shows managed resources, review statuses, sharing, and workspace security settings. The overview identifies Agents that need review, shows how Agents and Skills are shared, and summarizes configured workspace protections. To open it, go to *Workspace Settings → Governance → Overview*. ### Workspace inventory The workspace inventory shows the number and current status of managed resources. | Resource | Description | | :- | :- | | Agents | Total number of Agents, their access risk levels, the number without an owner, and the number published externally. | | Skills | Total number of Skills and the number without an owner. | | Connectors | Total number of Connectors and associated accounts in the workspace. | ### Sharing exposure The Sharing exposure shows how Agents and Skills are shared within and outside the workspace. A chart groups Agents and Skills by visibility and access permissions. * Private: Agents and Skills with no additional sharing. * Users: Agents and Skills shared with individual users. * User Groups: Agents or Skills shared with specific user groups. * Entire workspace: Agents or Skills available to everyone in the workspace. * Public: Agents published externally. ### Workspace protections This section shows the workspace’s current security and permission settings. | Setting | Description | | :- | :- | | Privacy Mode | Shows whether Privacy Mode is included in the current plan. | | Company guidelines | Shows whether company guidelines have been configured. | | Workspace sharing | Shows which roles can share resources with all users in the workspace. | | Allowed models | Shows how many AI models are permitted in the workspace. | *View All Permissions* opens the permission settings. *** ## Agents It shows all Agents in the workspace, including their owners, sharing, publication status, Governance reviews, and access risks. Search, filters, and sorting narrow the table. To open it, go to *Workspace Settings → Governance → Agents*. ### Search for Agents The search field finds Agents by name. ### Filter Agents Filters can be combined to narrow the table by: * **Quick filters:** Pending review, needs re-review, changes requested, or without owner. * **People:** Owners, editors, or people with whom Agents have been shared. * **Filters:** Status, review, access risk, visibility, model, Connectors, external publishing, knowledge, sharing, and workspace pin. Hide Agents that have not been shared from the table. ### Sort Agents Agents can be sorted alphabetically, by risk level, review urgency, usage frequency, or most recent use. ### Customize the Agent table The gear icon shows or hides columns such as Owner, Editors, Sharing, Review Status, Model, and access risk. ## Agent details Selecting an Agent opens its detail view. Administrators can inspect its configuration, permissions, usage, and changes across six tabs. | Tab | Description | | :- | :- | | Overview | Shows publication and review status, sharing, model, instructions, and connected Connectors, Skills, and knowledge sources. Administrators can also review the Agent and add internal notes. | | Checks | Shows access risks, configured actions, and access to connected resources. Administrators can identify risks and take appropriate action. | | Sharing | Shows the owner, access permissions, and connected resources. Administrators can change the owner, manage sharing, and enable admin-managed sharing. | | Analytics | Shows usage statistics, including active users, conversations, messages, and messages per user, for a selected period. | | History | Records changes and activity, including publications, sharing changes, Governance decisions, and internal notes. | Governance decisions take place in *Overview*. Owner and access-permission management takes place in *Sharing*. The other tabs primarily support inspection and assessment. ## Manage Agent sharing Administrators can review and manage who has access to an Agent. This includes taking administrative control of sharing settings, changing the owner, and updating access permissions. ### How it works 1. Open *Workspace Settings → Governance → Agents*. 2. Select the Agent. 3. Open *Sharing*. 4. Enable *Admin-Managed Sharing*, select *Change Owner*, or open *Manage sharing*, as needed. The Agent’s sharing settings and ownership are updated according to the selected changes. ### Admin-managed sharing *Admin-Managed Sharing* gives administrators central control over an Agent’s sharing settings. When enabled, sharing, public links, and Agent embedding can be changed only in Governance. Owners and editors can no longer manage those settings themselves, but can still edit the Agent within their existing permissions. ### Change owner *Change Owner* transfers responsibility for an Agent to another workspace member. The new owner receives full control of the Agent. The previous owner retains access according to their existing permissions. ### Manage sharing *Manage Sharing* controls access for individual users, groups, or the entire workspace. Administrators can grant read or edit access, change existing permissions, or remove access entirely. ## Review Agents Administrators can review published Agents in Governance and decide whether they should remain available. ### How it works 1. Open *Workspace Settings → Governance → Agents*. 2. Select the Agent. 3. Open *Overview* and select *Review*. 4. Select *Approve*, *Request Changes*, or *Disable*. 5. If needed, add a message for the owner or an internal note. 6. Save the decision. The review status updates to reflect the decision. Depending on the outcome, the Agent remains usable or is disabled until a reviewer approves it again. ### Understand Agent review statuses A published Agent’s review status indicates whether an administrative review has taken place, whether another review is needed, and what the reviewer decided. | Status | Meaning | Effect | | :- | :- | :- | | Approved | A reviewer approved the Agent. | The Agent remains usable. | | Pending review | The Agent has not yet been reviewed, or its published configuration has changed since the last Governance decision. | The Agent remains usable. | | Needs re-review | The Agent already has a reviewer decision, and its published settings or tools have changed since that decision. | The Agent keeps the effect of its last decision. The changed configuration is flagged for another Governance review. | | Changes requested | A reviewer requested changes to the Agent. | The Agent remains usable. The owner and editors can view the requested changes, and the owner receives an email. | | Disabled | A reviewer disabled the Agent. | The Agent can no longer be used in chat. The owner receives an email. | Users with the required permissions can publish and use Agents before a Governance review. Changes to published settings or tools may require another review. A disabled Agent remains disabled even after republication, until a reviewer approves it again. ## Assess Agent risks In *Workspace Settings → Governance → Agents*, the *Checks* tab helps administrators inspect published Agents, identify potential risks, and determine whether action is needed. ### Assess Access risk *The Access risk* section evaluates risks associated with actions from connected Connectors. The assessment considers whether actions require user confirmation and whether the Agent is published externally. | Status | Description | Recommended action | | :- | :- | :- | | Safe | The Agent has no external actions, or every external action requires user confirmation. | No action required. | | Potentially risky | At least one Connector action that writes data can run without user confirmation. The Agent can therefore change an external system without confirmation for each execution. | Enable user confirmation for the affected actions or explicitly accept the risk. | | High risk | The Agent is published externally through an embed, such as an iframe or widget, and has external actions, even if those actions require confirmation. Website visitors can trigger them and consume the workspace’s AI Usage. | Restrict external publication with the domain allowlist, disable embedding, or remove external actions. | ### Check access to connected sources The *Connected source access* section shows whether everyone who can use an Agent also has access to its connected Connectors, Skills, and knowledge sources. A mismatch may limit functionality or create a security risk. | Status | Description | Recommended action | | :- | :- | :- | | Passed | All Agent users can access its connected resources. | No action required. | | Own account needed | Not all users can access the Connector. Actions fail for affected users until they connect their own account. This does not create a risk of unauthorized data disclosure. | Connect an individual account or share the Connector appropriately. | | Needs attention | Not all users can access the connected Skill or knowledge source. The Agent answers without that resource. This does not create a risk of unauthorized data disclosure. | Share the resource with Agent users or accept the reduced answer quality. | | Needs attention | Users can run actions through the Connector owner’s account even though they do not have access to the MCP Connector themselves. This can occur when the Connector is configured as the Agent’s default integration. | Share the Connector correctly, restrict Agent sharing, or remove the Connector. An administrator can also disable the Agent during review. | ## Pin an Agent Administrators can pin an Agent to the *Pinned* section in the navigation for all users with access to it. This pin can only be removed through Governance and does not affect users' personal pins. ### How it works 1. Open *Workspace Settings → Governance → Agents*. 2. Select the Agent. 3. Click *Pin for users*. **Result:** The Agent appears in the *Pinned* section for all users with access until an administrator removes the pin. *** ## Skills It shows all Skills in the workspace, including owners, sharing, editors, associated files, and the number of Agents that use each Skill. Search, filters, and sorting narrow the table. To open it, go to *Workspace Settings → Governance → Skills*. ### Search for Skills The search field finds Skills by name. ### Filter Skills Filters can be combined to narrow the table by: * **People:** Owners, editors, or people with whom Skills have been shared. * **Filter:** Visibility, sharing and workspace pin. Private skills can also be hidden. ### Sort Skills Skills can be sorted alphabetically or by usage frequency. ### Customize the Skill table The gear icon shows or hides columns such as Owner, Editors, Sharing, Agents, Files, and access risk. ## Skill details Selecting a Skill opens its detail view. Administrators can inspect its configuration, permissions, associated files, and changes. | Tab | Description | | :- | :- | | Overview | Shows the Skill’s description, status, instructions, additional files, sharing details, and Agents that use it. | | Sharing | Shows the owner and access permissions. Administrators can change the owner, manage sharing, and enable admin-managed sharing. | | History | Records changes and activity, such as sharing changes and the activation of admin-managed sharing. | Owner and access-permission management takes place in *Sharing*. When admin-managed sharing is enabled, access permissions can be changed only through Governance. The other tabs primarily provide access to configuration, content, and change history. *** ## Connectors It shows integrations and MCP servers in the workspace, including connected accounts, sharing, connection status, and how Connectors are used in Agents, Workflows, and Apps. To open it, go to *Workspace Settings → Governance → Connectors*. ### Review Connector metrics The top section summarizes Connector usage and status. | Metric | Description | | :- | :- | | Connector Calls | Total number of Connector calls in the last 30 days. | | Connections | Number of connected accounts, including how many connections are shared. | | Active Connectors | Number of active Connectors and connections with errors. | | Connectors in Use | Number of Connectors in use and not in use. | ### Search Connectors The search field finds Connectors by name. ### Filter Connectors Filters can be combined to narrow the table by: * **People:** Users associated with connected accounts. * **Filter:** Visibility. Private resources can also be hidden. ### Sort Connectors Connectors can be sorted alphabetically or by usage frequency. ### Customize Connector table The gear icon shows or hides columns such as Connected Accounts, Shared Accounts, Agents, Workflows, Apps, Calls in the Last 30 Days, Status, and Owner. ## Connector details Selecting a Connector opens its detail view. Administrators can inspect connection status, connected and shared accounts, usage across Agents, Workflows, and Apps, and recorded changes. | Tab | Description | | :- | :- | | Overview | Shows the Connector’s status, connected and shared accounts, usage across Agents, Workflows, and Apps, and Connector calls in the last 30 days. | | Connected accounts | Lists all connected accounts, who connected them, their sharing status, where they are used, and when they were last used. | | History | Records changes to the Connector, including sharing, publishing, and ownership changes. | The Connector overview and detail view support centralized inspection of connections, sharing, and usage. Connector and sharing management takes place under *Workspace Settings → Connectors*. ## FAQ > [accordion] Who can publish Agents? > > Administrators define which roles can publish Agents under *Workspace Settings → Permissions → Agent Publication*. Permission to create Agents is enabled by default for Admins and Editors. > [accordion] Can Agents be published regardless of their Governance review status? > > Yes. Users with the required permissions can publish Agents regardless of review status. Agents remain usable while a review is pending or changes have been requested. Agents disabled during a Governance review are the exception: they cannot be used again until a reviewer approves them. > [accordion] When is an Agent re-review required? > > A re-review is triggered when the published configuration of a previously reviewed Agent changes, such as its instructions, tools, actions, or settings. The previous review decision remains in effect, but the Agent is marked as *Needs re-review*. > [accordion] How can administrators edit an Agent’s knowledge, integrations, and other settings? > > In *Sharing*, administrators can assign themselves as the owner or grant themselves edit access. They can then open the Agent in the Agent Builder to update its knowledge, integrations, and other settings. > [accordion] When is an Agent’s review status determined? > > An Agent is published when a user creates and saves it. Its review status is determined automatically upon publication. Later changes to the published configuration may require another review. > [accordion] What is the difference between review status and access risk? > > Review status records whether an Agent has been reviewed administratively and what decision the reviewer made. Access risk independently assesses potential risks from external actions and their configuration. An Agent can therefore have *High Risk* access risk while its review status is *Approved*. It can also be *Safe* while a review is still pending. > [accordion] What happens when an Agent’s owner leaves the workspace? > > Governance identifies published Agents without an owner. An administrator can open the Agent’s *Sharing* tab and use *Change Owner* to assign responsibility to another workspace member. > [accordion] What changes when admin-managed sharing is enabled? > > Sharing settings, public links, and Agent embedding can then be changed only in Governance. Owners and editors retain their existing ability to edit the Agent, but can no longer manage those sharing settings themselves. > [accordion] Why can an Agent work for some users but not others? > > The Agent’s users may not all have access to its connected sources. In the Agent detail view, the *Checks* tab shows whether all users can access the Agent’s connected Connectors, Skills, and knowledge sources. Connector actions may fail until affected users connect their own accounts; without access to a Skill or knowledge source, the Agent answers without that source. > [accordion] Where can administrators see which Agents, Workflows, and Apps use a Connector? > > Open the Connector in *Workspace Settings → Governance → Connectors*. Its detail view shows connected accounts and provides separate *Agents*, *Workflows*, and *Apps* tabs. Connector and sharing settings are managed under *Workspace Settings → Connectors*, not in the Governance detail view. > [accordion] Where can administrators review changes to an Agent? > > The Agent’s *History* tab records activity such as publications, sharing changes, Governance decisions, and internal notes. This provides a record of changes alongside the Agent’s current configuration and review status. > [accordion] Where can the Governance module be managed? > > The Governance module is enabled by default and can be managed under *Settings → Modules*. When disabled, the Governance section is no longer available. > [accordion] Are private resources visible in Governance? > > Private resources appear in the Governance overview by default. Enabling *Hide private resources in Governance* excludes resources that have not been shared with other users. > [accordion] Who can access the Governance module? > > Access is managed under *Settings → Permissions*. The *Read* permission is enabled for Admins by default and can be granted to additional roles. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.