> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent governance

> Control who builds, edits, and runs Agents, which tools and MCP servers each Agent may use, and what a run can reach.

Governance covers three decisions: who may build and edit an Agent, what the Agent may use, and what a run can reach.

A workspace role decides who builds Agents: **Admin** and **Developer** create, edit, and delete them, and **Researcher** has view access. [Roles](https://docs.orq.ai/ai-studio/organization/members-teams.md#roles) lists the permission for every role.

## What an Agent may use

Each Agent carries its own capability scope, chosen when it is built. Add [tools](https://docs.orq.ai/ai-studio/ai-engineering/build-agents.md#add-tools), [MCP servers](https://docs.orq.ai/ai-studio/ai-engineering/build-agents.md#mcp-servers), and [skills](https://docs.orq.ai/ai-studio/ai-engineering/skills.md), and connect the knowledge bases it may read. A run reaches the tools and servers on the Agent.

## What a run can reach

* **MCP gateways**: a run reaches the gateways attached to its Agent, and each gateway is shared with projects. A key minted for an Agent session carries only that Agent's gateways. See [Project access](https://docs.orq.ai/ai-gateway/mcp-portal/mcp-gateways.md#project-access).
* **API keys calling the Agent**: the key's permission domains, its project scope, its `mcp_access` allowlist, and any [Budget](https://docs.orq.ai/ai-gateway/budgets.md) scoped to it. See [API keys](https://docs.orq.ai/ai-studio/organization/api-keys.md#permissions).

## What an Agent runs as

A run acts as whoever invokes it: a member's session carries that member's role, and an API key carries the key's grants. Two Agents built by the same person run with that person's permissions.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.