Drata AI Agent Governance

Drata AI Agent Governance extends Drata's compliance-automation platform to the AI agents running inside an enterprise. A device sensor discovers every agent including shadow deployments, an MCP proxy blocks policy violations inline before a tool call executes, and a tamper-evident evidence feed turns agent activity into audit material mapped to the EU AI Act, ISO 42001 and AIUC-1.

Drata AI Agent Governance extends Drata's trust-management and compliance-automation platform from human and infrastructure controls to the AI agents running inside an enterprise. It works through three layers. A sensor on managed devices detects and registers every agent at inception — including shadow agents nobody declared — and maps each to its owner, identity, permissions and scope. An MCP proxy sits in the tool-call path and evaluates each agent request against organisational policy, blocking violations inline before execution rather than alerting after the fact. A telemetry and evidence feed reduces and masks device activity before writing it into a tamper-evident evidence system, producing a chain of custody rather than a log an operator could edit. Policies are authored in plain English and compiled into machine-enforceable rules, and Drata's Trust Ladder promotes each policy through Training, Recommendation and Active stages, letting teams simulate it against up to a year of historical traffic before enforcement is switched on. Drift detection continuously flags agents whose behaviour moves outside their declared scope, and the resulting evidence feeds existing compliance programmes with pre-mapped coverage for the EU AI Act, ISO 42001 and AIUC-1 alongside Drata's 30-plus existing frameworks such as SOC 2, ISO 27001 and GDPR. The product entered Limited Availability on 4 August 2026 behind an early-access application, with early customers already running it end to end in production; it ships first and deepest for Anthropic, while OpenAI, Google Vertex AI and AWS Bedrock support are in active development. Drata was founded in 2020 in San Diego, has raised $328M at a $2B valuation, employed roughly 689 people as of May 2026, and crossed $100M in annual recurring revenue in 2025.

Category

Governance & Security

Pricing

Contact for pricing, Subscription

Target Market

CISOs, CIOs, GRC and Compliance Teams, Security Architects, Internal Audit

Deployment

Cloud-first, Hybrid

Founded

2020

Headquarters

San Diego, California, USA

Team Size

500+

Customers

Not disclosed for this product — it is in Limited Availability with early-access customers in production; Drata's wider platform processed 2.1 million security questions in nine months

• ✓
  Drata Sensor

  Detects and registers every AI agent at inception on managed devices, mapping each to owner, identity, permissions and scope.

• ✓
  Mission Control inline enforcement

  Evaluates each agent action against policy and blocks violations before execution rather than raising an alert afterwards.

• ✓
  MCP proxy

  Sits in the Model Context Protocol tool-call path so every agent tool request is checked against organisational policy at runtime.

• ✓
  Trust Ladder staged rollout

  Promotes policies through Training, Recommendation and Active stages, validating each against real traffic before enforcement is enabled.

• ✓
  Plain-English policy authoring

  Policies are written as intent in plain English and compiled into machine-enforceable rules, so GRC staff need not write code.

• ✓
  Drift detection

  Continuously monitors for agents operating outside their declared scope and flags the deviation immediately rather than at audit time.

• ✓
  Tamper-evident chain of custody

  Reduces and masks device telemetry before writing decisions to an evidence store auditors can rely on as unaltered.

• ✓
  AI framework mapping

  Pre-maps evidence to the EU AI Act, ISO 42001 and AIUC-1 alongside Drata's 30-plus existing compliance frameworks.

• •
  Finding shadow AI agents on employee devices

  The sensor surfaces coding assistants and custom agents that staff deployed without any security or compliance review.

• •
  Blocking an out-of-policy tool call before it runs

  The MCP proxy rejects an agent's attempt to reach a resource its scope does not cover, preventing rather than reporting the breach.

• •
  Testing an agent policy before enforcing it

  Teams replay a proposed policy against up to a year of historical traffic to size the blast radius before turning enforcement on.

• •
  Producing EU AI Act evidence on autonomous systems

  Tamper-evident decision logs map directly into an existing compliance programme instead of being assembled by hand for each audit.

• •
  Catching behavioural drift in a deployed agent

  Continuous monitoring flags an agent whose access patterns move outside its declared scope well before the next audit cycle.

No list pricing is published anywhere on Drata's site — the pricing page carries only Contact Sales and demo calls to action, and AI Agent Governance is additionally gated behind a Limited Availability application, so it is not self-serve at any price. Hacker News practitioners repeatedly place Drata's base compliance platform at roughly $10,000-$15,000 per year for a small company, with several noting that opacity itself is a barrier and that the cost keeps seed-stage teams away; treat agent governance as an add-on to that, negotiated annually. Ask specifically whether metering is per agent, per managed device or per seat, because the device sensor implies endpoint-based counting.

This page was written from 7 sources, 5 on domains other than drata.com.

1. 1.drata.com — agent governancevendor
2. 2.drata.com — pricingvendor
3. 3.trust.drata.com — trust.drata.com
4. 4.securityboulevard.com — drata opens limited availability for ai agent governance pro
5. 5.itbrief.co.uk — drata launches ai agent governance for anthropic users
6. 6.helpnetsecurity.com — drata ai agent governance
7. 7.hn.algolia.com — hn.algolia.com