AgentVouchOpen app

Support & how-to guides

Step-by-step help for every connection and feature in AgentVouch.

Drata two-way sync

Team → GRC platform connections

Push agents to Drata as vendors and let a Drata approval approve the agent here.

  1. In Drata, open Settings → Developer settings → API keys and create a key with vendor read/write access.
  2. In AgentVouch, go to Team → GRC platform connections and click Add connection.
  3. Choose Drata, connection type REST API, paste the key and save. The key is hidden after saving; only its last 4 characters are shown.
  4. Click Test to confirm Drata answers.
  5. When an agent is requested with live data, or moved to live data, it is added to Drata as a vendor marked Under review.
  6. Every 15 minutes AgentVouch checks Drata. Approved/Active in Drata approves the agent here; Rejected blocks it.
  • The agent page shows a Drata sync panel with the latest status.
  • Only Owners and Admins can add or remove connections.

Other GRC platforms (Vanta, Secureframe, OneTrust)

Team → GRC platform connections

Save API or MCP connection details for other compliance tools.

  1. Create a read-only API key (or MCP server URL) in the platform.
  2. Add connection → pick the platform → choose REST API or MCP server.
  3. Enter the endpoint URL and key, save, then click Test.
  4. Use Disable to pause a connection or Remove to delete it.
  • Automatic sync is currently built for Drata only; other platforms are stored and tested.

Outbound webhooks (Slack, SIEM, Splunk, Sentinel)

Team → Outbound webhooks

Send a signed message to another system whenever an agent changes.

  1. Create an incoming endpoint in your tool (e.g. a Slack workflow or SIEM HTTP collector).
  2. In Team → Outbound webhooks, add the URL and an optional shared secret.
  3. Tick the events you want: agent created, status changed, approved, recertified, blocked.
  4. Save and trigger a change on an agent to see a delivery.
// Node.js signature check
import crypto from "node:crypto";
const expected = crypto.createHmac("sha256", SECRET).update(rawBody).digest("hex");
const ok = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signatureHeader));
  • If you set a secret, each request carries an HMAC-SHA256 signature header your receiver can check.

Shadow AI discovery: Microsoft Copilot Studio

Team → Shadow AI discovery

Find Copilot Studio agents that aren't registered in AgentVouch.

  1. In the Power Platform admin centre, copy your environment URL (https://yourorg.crm.dynamics.com).
  2. In Microsoft Entra ID, create an app registration with read-only Dataverse access and get an access token.
  3. Add source → Microsoft Copilot Studio → paste the URL and token.
  4. Click Scan now. Agents not in your register are listed with a Register button; dismiss ones you don't need.

Shadow AI discovery: Azure OpenAI

Team → Shadow AI discovery

List model deployments and assistants on an Azure OpenAI resource.

  1. In the Azure portal, open your Azure OpenAI resource → Keys and Endpoint.
  2. Copy the endpoint (https://yourname.openai.azure.com) and a key.
  3. Add source → Azure OpenAI → paste both, then Scan now.

Shadow AI discovery: AWS Bedrock

Team → Shadow AI discovery

List Bedrock agents in an AWS region.

  1. In AWS IAM, create a user with only the bedrock:ListAgents permission and an access key.
  2. Add source → AWS Bedrock → enter the region (e.g. eu-west-2).
  3. Enter the credential as ACCESS_KEY_ID:SECRET_ACCESS_KEY, save and Scan now.

Enterprise single sign-on (Entra ID, Okta, Ping)

Team → Enterprise single sign-on

Let staff sign in with their company login.

  1. In your identity provider, create a SAML 2.0 app for AgentVouch.
  2. Send us the provider's metadata URL and your company email domains so they can be registered.
  3. Staff then click Sign in with SSO on the sign-in page and enter their work email.
  4. New SSO users join with the Requester role; an Admin can change it on the Settings page.

Inviting people and roles

Team → Members

Add colleagues and control what they can do.

  1. Team → Invite member → enter their email and choose a role.
  2. Copy the invite link and send it; they must sign in with that same email to accept.
  3. Roles: Owner, Admin, Requester, Reviewer, Approver, Auditor, Information Security Manager, Data Compliance Lead.

Approval chains and sign-offs

Agent page → Approval chain

Required sign-offs depend on how sensitive the agent's data is.

  1. Low (prototype/dummy data): no extra sign-offs.
  2. Medium (live data): Information Security Manager.
  3. High or Critical (live personal data, or EU AI Act high risk): Information Security Manager, then Data Compliance Lead.
  4. Each step must be signed by a different person. Approve for live unlocks once all are done.

Recertification campaigns

Team → Recertification campaigns / Agent page

Owners re-confirm each agent every 90 or 180 days.

  1. On the Settings page, pick every 90 or 180 days.
  2. On the agent page, the owner ticks: data scope, prompt boundaries and vendor dependencies unchanged.
  3. If something changed, describe it — a live agent goes back to review.
  4. Owners get alerts when an agent is due soon (14 days) or overdue.

EU AI Act, NIST & ISO 42001, audit packs

Agent page → Compliance frameworks

Classify each agent and export a dossier for auditors.

  1. Answer the five EU AI Act screening questions; the risk level and obligations appear automatically.
  2. Tick NIST AI RMF and ISO 42001 controls to see coverage.
  3. Record model versions as they change.
  4. Use Print / save as PDF or Download ZIP for the full audit & board pack.

Registering and reviewing agents

Agents

The core workflow from request to approval.

  1. Agents → Register → fill in name, purpose, platform and data type.
  2. Reviewers complete the risk assessment and checklist.
  3. Approvers approve once sign-offs are done; agents can later be retired.
  4. Use search, status filter and Export backup on the Agents page.