14 Oct 2026 · Nadia Ferreira-Strand (editorial persona) · MSP and SMB channel · on threat.cafe

Your clients' staff are installing AI agents: an MSP's first 90 days of agent governance

Run agent governance for a client in three 30-day blocks. Days 1–30: find which coding agents, MCP servers and skills are on managed endpoints. Days 31–60: agree a default policy with the client and push it through the device management you already run. Days 61–90: report what was found, what was blocked and what is still open. Start with one client. Most published MSP AI guidance stops at chat tools and data leakage. Agents that run commands and install software need endpoint controls, and MSPs already own the endpoints.

Outcome, time and access

Outcome. One client with a known agent inventory, an agreed written policy, enforced settings on managed machines, and a first quarterly report.

Time. Roughly 90 calendar days. Most of the effort falls in the first 30.

Access you need. Your RMM or MDM with script execution on client endpoints. Admin rights to the client's Claude, GitHub or Cursor organisation, or a client contact who has them. A signed scope that covers agent governance.

Use this plan if, do not use if

Use it if a client's developers or power users run Claude Code, Cursor, GitHub Copilot's agent features or similar tools on machines you manage.

Do not use it if the client only uses browser chat assistants. Chat-focused guidance, like Cynomi's July 2026 MSP guide, fits that case better. That guide covers discovery, an approved lane, DLP, DNS filtering and training. It does not mention coding agents, MCP servers or skills.

Why this is an MSP job

Two facts make the case.

First, the tools are already in use. Verizon's 2026 Data Breach Investigations Report found frequent employee use of AI tools rose from 15% to 45% in a year, based on 2025 data (Verizon, 19 May 2026).

Second, policy is not reaching the front line. Auvik's 2026 IT Trends Report found 76% of IT leaders say they have an AI policy, against 42% of help desk staff, per SC Media. The same report found 36% of MSPs use 10 or more tools. Do not add an eleventh. Use the RMM and MDM you already run.

Days 1–30: discovery

Step 1: Agree scope in writing

List the client's machines in scope and name the client owner who approves policy. Do not start scanning before this is signed.

Step 2: Find agent configuration on endpoints

Push a read-only script through your RMM. Collect the existence, owner and modified date of known agent config paths. Do not collect file contents yet; they can hold secrets.

Claude Code   ~/.claude/settings.json
              ~/.claude.json            (user MCP servers)
              <repo>/.mcp.json          (project MCP servers)
              ~/.claude/skills/         (personal skills)
              ~/.claude/skills/synced/  (skills synced from claude.ai)
Cursor        ~/.cursor/mcp.json        (global MCP servers)
              <repo>/.cursor/mcp.json   (project MCP servers)

These paths come from Anthropic's skills docs, the managed MCP guide and Cursor's MCP docs. Add paths for other agents only after checking their own documentation.

Verify. Run the script on one machine where you know an agent is installed. If it reports nothing, fix the script before fleet rollout.

Step 3: List servers and skills per machine

For machines with agent config, collect MCP server names, commands and URLs, and skill folder names. Redact env values and headers at collection time.

Step 4: Ask the people

Send the client's developers three questions. Which agents do you use? Which MCP servers? Anything installed from a search result? Endpoint data misses personal machines and cloud sessions. Interviews catch some of that.

Exit criterion for day 30. A spreadsheet: machine, user, agent, MCP servers, skills, last modified. Expect gaps.

Days 31–60: policy and enforcement

Step 5: Agree the default policy

Use the template below. Walk the client owner through each line. Record their decisions, not yours.

CLIENT AGENT POLICY (v1)
------------------------------------------------------------------
Approved agents          [list]; others need written approval
Default permission mode  [the agent's own setting, named]
MCP servers              allowlist only; match on URL or exact
                         command with version; never on name
Skills                   from [approved sources] only
Unknown artifacts        [warn and log | require approval | block]
Known-bad artifacts      block, on every machine, no exceptions
New agent tools          checked against the official channel
                         before install
Exceptions               written, with owner and expiry date
Review                   quarterly, and after any incident
Owner                    [client name]   MSP contact [name]
------------------------------------------------------------------

Step 6: Push MCP policy through device management

Claude Code reads a managed-mcp.json from a system path: /Library/Application Support/ClaudeCode/ on macOS, /etc/claude-code/ on Linux, and C:\Program Files\ClaudeCode\ on Windows. Anthropic's docs name Jamf, Group Policy and Intune as typical delivery. That file gives exclusive control. For a softer start, deploy allowedMcpServers and deniedMcpServers in managed settings with allowManagedMcpServersOnly: true.

For GitHub Copilot, MCP allowlists live in copilot/managed-settings.json in the organisation's .github-private repository, per GitHub's changelog. Cursor's allowlist sits in Team Settings.

Verify. On a managed Claude Code machine, run claude mcp list. It should show only approved servers. Then try adding a test server. Anthropic's docs show the expected refusal: not allowed by enterprise policy.

Step 7: Tell users before you block

The docs warn that a server blocked by policy "silently disappears" from the list with no signal to the user. Send the client's staff a short note naming what is blocked and how to request an exception. This prevents a support-ticket spike in week one.

Step 8: Pilot, then widen

Deploy to five machines for one week. Then the rest.

Days 61–90: reporting

Step 9: Build the quarterly report

Keep it to one page:

agents found, by count of machines
MCP servers and skills found; how many are approved
blocks in the quarter, with the artifact and reason
open exceptions, with expiry dates
the one next step for next quarter

Step 10: Present it

Present with the client owner. Ask for one decision: approve the next step, or record why not.

Failure modes and fixes

Failure 1: the inventory misses cloud and personal sessions. Endpoint scripts only see managed machines. Fix: say so in the report. Pair it with the claude.ai or GitHub organisation admin view where the client has one.

Failure 2: users widen the allowlist. Without allowManagedMcpServersOnly, Claude Code merges allowlists from a user's own settings. Fix: set the lock in managed settings, then re-check claude mcp list on a user machine.

Failure 3: name-based entries. An entry like { "serverName": "github" } matches any server a user calls github. Both GitHub and Anthropic say name matching is not a security control. Fix: rewrite as serverUrl or serverCommand.

Failure 4: unpinned commands. An allowlisted npx -y PACKAGE fetches whatever version is newest. Fix: put the exact version in the command.

Failure 5: one agent governed, another not. The client's policy covers Claude Code; half the team uses Cursor. Fix: the policy's "approved agents" line drives enforcement per agent. Unenforced agents go on the report as open.

Failure 6: the scope does not cover it. You discover something serious on day 12 and your contract says nothing about agents. Fix: Step 1. Get scope signed first.

Rollback

If enforcement breaks a client's work:

Remove the managed file or setting through the same MDM policy that pushed it.
Confirm on one machine that claude mcp list shows the user's servers again.
Keep the denylist in place even when rolling back the allowlist. Known-bad blocks should never be the thing you remove.
Record what broke and add it as an exception or allowlist entry before redeploying.

A note on pricing

This plan has not been priced against real MSP engagements. Scope it by effort: discovery is the largest block and scales with machine count; enforcement is mostly one-time; reporting is recurring. Validate any price with your own first client before you list it.

The threat.cafe board lists documented malicious agent artifacts with sources, which can seed the "known-bad" line of the client policy.

Sources

#msp #agent-governance #mdm #managed-settings #client-policy

All posts