MW. Résumé / CV

Portfolio proof of concept

AI and MCP access governance

May to July 2026.

A working demonstration of structured review for AI agent integrations and MCP-connected tools. Each integration is treated as a governed access request, not unmanaged developer tooling.

AI agents and MCP-connected tools can receive data, call APIs and trigger actions across SaaS, cloud and internal platforms. The platform puts a repeatable control loop in front of that, using fictional vendors and mock intake data.

The n8n workflow canvas: an MCP request passes a pre-approval check, a nine-rule security linter, a risk classifier and an AI research agent, then waits for human security review before the decision is written to an evidence log.
The built n8n workflow, from intake through human review to the evidence log. Open full size

The control loop

  • Request. Capture the owner, purpose, data class, environment and tool details.
  • Classify. Evaluate privilege, data exposure, tool behaviour and vendor maturity.
  • Review. Route material risk to an accountable reviewer, with conditions where needed.
  • Evidence. Record the final decision in a durable, structured format.

What's in it

  • One runnable n8n workflow
  • Eight control objectives and four risk levels
  • 42 passing tests

Portfolio proof of concept. Not a production deployment, certification or attestation. My approach to MCP governance has moved on since.

More projects