Nerve · answers
AI agent governance: build vs buy
Last reviewed
Short answer: Build if governing agents is the product you sell; buy if it is a control you need, because the approvals, credential handling, isolation, audit and scanning below are a standing programme of work rather than a one-off project.
What a build has to deliver
Whichever route you take, a governed agent workforce needs each of these. Treat it as a checklist for your own estimate.
- Approvals that agents cannot grant themselves, with refusals recorded.
- Credentials kept away from agents, with a response when one leaks.
- Isolation between teams or customers that holds even when application code is wrong.
- An audit trail a reviewer can read without engineering help.
- A path to production that verifies work before a human is asked to approve it.
- Vulnerability, secret and supply-chain scanning that reports real findings.
- Spend visibility and limits per agent.
- Identity integration with your directory.
What Nerve ships for those items today
- An agent can ask to deploy; it can never approve its own request.
- Every blocked attempt is audited.
- Agents never hold provider credentials; the platform performs the privileged action on their behalf.
- When a credential appears in an agent’s output, the stream is cut and a rotation gate opens.
- Tenant isolation is enforced at the database and fails closed: even the database owner role cannot read another tenant’s rows.
- Nerve keeps an admin and chat audit trail.
- The real build and full test suite must pass before the approval gate opens; a failing build never merges.
- Nerve runs real vulnerability scanning, including dependency CVEs, SAST and secret detection, on every tenant, not mock findings.
- Nerve shows cost per agent and per model, with daily trends.
- Budgets warn and then pause for a human.
- Nerve supports OIDC single sign-on and SCIM 2.0 provisioning.
Where buying is not the answer
- Nerve is not self-hosted by default, and it does not currently offer a fully air-gapped deployment.
- Nerve is a managed service by default; on-premises is available for enterprise customers at significant cost.
- AWS is the one live production deployment target today; other cloud providers are not yet validated against live infrastructure.
How to decide
- Price the checklist above for your own team using your own salaries and timelines, then compare it with a quote. Book an assessment if you want to talk it through.