企业 Agent 控制层 Enterprise Agent Control Plane

不管理 Agent 有多聪明。
管理它被允许做什么。 Don't govern how agents think.
Govern what they're allowed to do.

Charter 位于 Agent 与企业资源之间。每一次工具调用都经过身份识别、能力授权、策略判断、必要审批、执行控制与全程审计。不替代你的 Agent，也不侵入业务系统。 Charter sits between agents and enterprise resources. Every tool call is identified, authorized, decided, approved when needed, enforced, and written to a ledger. It does not replace your agents, and it does not invade your systems of record.

预约演示Book a demo 了解控制闭环See the control loop
接入Connect
< 15 min
网关附加延迟Added latency
P95 < 50ms
拒绝 / 暂停Deny / pause
不到达上游Never reaches upstream

核心判断 The real question

企业不会只有一个 AI 助手。
问题也不是谁更聪明。 Enterprises will not have one assistant.
Intelligence is not the problem.

OpenAI、Anthropic、Gemini、Grok、国产大模型、IDE Agent、浏览器 Agent、部门自建的小型 Agent——它们会同时存在。传统 IAM 管理的是人到系统。Charter 管理的是 Agent 到能力、到资源、到动作。 OpenAI, Anthropic, Gemini, Grok, domestic models, IDE agents, browser agents, and homegrown departmental bots will run side by side. Classic IAM governs people to systems. Charter governs agent to capability, to resource, to action.

让企业里的每一个 Agent 都有身份、有边界、有责任、有记录。 Give every agent in the enterprise identity, bounds, accountability, and a record.

定位Position

不控制 Agent，
控制它对外产生的副作用。 Do not control the agent.
Control the side effects it creates.

不同厂商的推理、Prompt、模型与内部循环无法统一，也不需要统一。Charter 是 Policy Enforcement Point，不是集成平台，更不是 Agent Builder。已有 Agent 能访问的能力，经过控制层即可被治理。 Reasoning, prompts, models, and inner loops cannot be unified across vendors — and they don't need to be. Charter is a policy enforcement point, not an integration suite, and not an agent builder. If an agent can already reach a capability, Charter can govern it.

  • 不做 Agent 编排或 Chatbot BuilderNot an agent orchestrator or chatbot builder
  • 不替代 AD / SSO / IAMNot a replacement for AD, SSO, or IAM
  • 不替代 API GatewayNot a replacement for an API gateway

01 — Control Loop

一次调用，一条完整的治理链路。 One call. One complete governance path.

从身份到账本，每次 MCP 工具调用都走同一条可解释的决策路径。允许才会转发；拒绝与待审批不会产生外部副作用。 From identity to ledger, every MCP tool call follows the same explainable path. Only Allow is forwarded. Deny and pending approval never create an upstream side effect.

  1. 01

    身份Identity

    每个受管 Agent 拥有稳定身份与凭证。运行时不能仅凭自报名称取得权限；停用、轮换、实例与环境隔离从一开始就成立。Every managed agent has a stable identity and credential. A self-asserted name is never enough. Disable, rotation, instance and environment isolation hold from the first request.

  2. 02

    能力Capability

    MCP Tool 自动映射为企业能力，例如 payment.execute → finance.payment.execute。治理的是「能做什么」，而不是一串 API 名称。MCP tools map to enterprise capabilities — payment.execute becomes finance.payment.execute. You govern what an agent can do, not a raw API catalog.

  3. 03

    策略Policy

    OPA 对结构化条件求值。WHO、CAN DO、ON、WHEN、WITH 同时约束主体、能力、资源与上下文，结果始终指出命中的策略。OPA evaluates structured conditions. WHO, CAN DO, ON, WHEN, WITH constrain subject, capability, resource, and context. Every result names the policy that fired.

  4. 04

    审批Approval

    高风险动作暂停，而不是提前执行。批准后至多恢复一次，包括并发审批与进程恢复；拒绝则终止。High-risk actions pause instead of executing early. An approval resumes at most once — including concurrent clicks and process recovery. Rejection stops the call.

  5. 05

    执行Enforce

    Allow / Deny / Require Approval 在托管 MCP 网关强制生效。Agent 级与能力级 kill switch 可立刻切断。Allow, Deny, and Require Approval are enforced at the managed MCP gateway. Agent-wide and per-capability kill switches cut the path immediately.

  6. 06

    账本Ledger

    认证失败、拒绝、审批、上游失败与成功都留下相关决策记录。谁、何时、为什么、通过哪个 Agent、对什么资源做了什么，可查可导出。Auth failure, deny, approval, upstream failure, and success all write a correlated decision record. Who, when, why, which agent, which resource — queryable and exportable.

02 — MCP Gateway

Agent 不再直连工具。它连 Charter。 Agents no longer talk to tools. They talk to Charter.

开发者登记 MCP 连接，平台完成 Discovery，签发 Managed MCP Endpoint。把原地址换成该端点，治理即开始。目标用时少于十五分钟。 Register an MCP connection, let Charter discover tools, and receive a managed endpoint. Replace the original URL. Governance starts. Target: under fifteen minutes.

Agents

  • Finance Copilot
  • Recruiting Agent
  • IDE Coding Agent

Charter

托管 MCP 网关Managed MCP gateway

identity → capability → policy → enforce

MCP Servers

  • finance.tools
  • hr.internal
  • github · slack

Streamable HTTP

官方 MCP Go SDK。发现 Tools、Resources、Prompts，把 Tools 作为重点治理对象。Official MCP Go SDK. Discover tools, resources, and prompts — tools are the primary governed object.

OPA + PostgreSQL

结构化策略由 OPA 求值。载荷列使用 AES-256-GCM 加密。可 Docker Compose 或 Helm 部署。OPA evaluates structured policy. Payload columns use AES-256-GCM. Deploy with Docker Compose or Helm.

Bypass-free

被拒绝、被 kill、待审批的调用不会到达上游 MCP Server。相同动作只进入一次有效执行路径。Denied, killed, and pending-approval calls never reach the upstream MCP server. The same action enters one valid execution path.

03 — Policy

用企业语言写规则。
用同一引擎做决定。 Write rules in business language.
Decide them with one engine.

Finance Copilot

WHO
finance-copilot · production
CAN DO
finance.payment.execute
ON
payment/*
WHEN
amount < 10,000 CNY
WITH
allow

小额付款可自动执行。Small payments may execute automatically.

Finance Copilot

WHO
finance-copilot · production
CAN DO
finance.payment.execute
ON
payment/*
WHEN
10,000 ≤ amount ≤ 100,000
WITH
approval finance-managers

中额必须由财务经理批准后恢复，且只恢复一次。Mid-size amounts pause for a finance manager, then resume at most once.

Finance Copilot

WHO
finance-copilot · production
CAN DO
finance.payment.execute
ON
payment/*
WHEN
amount > 100,000 CNY
WITH
deny

大额禁止 Agent 自动执行。建议可生成，付款不能发生。Large amounts are forbidden for autonomous execution. Advice can be drafted. Payment cannot fire.

04 — Progressive control

从旁路观察开始。
按风险把控制拧紧。 Start on the side.
Tighten control as risk demands.

企业不需要一次性完成改造。先看清 Agent 在做什么，再留下证据，最后对高风险路径强制执行。 No big-bang rewrite. First see what agents are doing, then keep evidence, then enforce the high-risk paths.

  1. Observe

    观察Watch

    只观察，不拦截。弄清企业里到底运行了多少 Agent、调用了哪些能力。Watch without blocking. Learn how many agents actually run, and which capabilities they touch.

  2. Audit

    审计Record

    为每次结果写下可关联账本。合规与内控从此有证据，而不是聊天记录。Write a correlated ledger for every outcome. Compliance gets evidence instead of chat logs.

  3. Enforce

    强制Enforce

    允许、拒绝、或暂停等待审批。Kill switch 可按 Agent 或按能力立刻切断。Allow, deny, or pause for approval. Kill switches cut an agent or a single capability immediately.

05 — Operations console

把权威、决定、待办，放在同一张工作台上。 Authority, decisions, and work waiting for humans — on one desk.

06 — In the enterprise

同一套控制层，覆盖不同风险的 Agent。 One control plane. Agents with very different blast radii.

Finance

财务分析 Agent 可以建议付款，但不能把钱打出去。A finance agent may recommend a payment. It may not send the money.

读取报表、生成建议：允许。执行付款按金额分流：自动、审批、或禁止。Owner 落在财务共享中心，生产实例与开发实例权限不能串用。Read statements and draft advice: allow. Execute payment splits by amount: automatic, approval, or forbidden. Ownership sits with the shared-service center. Production and developer instances never share authority.

People

招聘 Agent 可以读简历，不能把名单带走。A recruiting agent may read resumes. It may not walk out with the roster.

单份简历检索允许；批量导出个人信息拒绝。发送 Offer 必须经 HR 审批后恢复。敏感能力可被单独 kill。Single-resume search is allowed. Bulk export of personal data is denied. Sending an offer pauses for HR. Sensitive capabilities can be killed on their own.

AI 平台负责人AI platform lead

企业到底运行了多少 Agent，用了哪些能力，有没有失控。How many agents actually run, which capabilities they hold, and whether any are unbound.

CIO / IT

统一治理、避免厂商锁定、可运维、可审计、成本可解释。Unified governance without vendor lock-in. Operable, auditable, cost-explainable.

安全 / 合规Security / compliance

越权、泄露、身份冒用、高风险未审批——都要留下证据。Overreach, leakage, identity spoofing, unapproved high-risk acts — all leave evidence.

Agent 开发者Agent developers

换一个 MCP 地址，而不是为了治理重写 Agent。Swap an MCP URL. Do not rewrite the agent in order to be governed.

Charter

为每一个 Agent 签发章程。 Issue a charter for every agent.

身份、边界、责任、记录——从第一次工具调用开始。预约一次演示，把现有 MCP Agent 放进控制层。 Identity, bounds, accountability, record — starting with the first tool call. Book a demo and put an existing MCP agent on the control plane.

预约产品演示 → Book a product demo →