# AI agent governance: build vs buy

Last reviewed: 2026-10-23

**Short answer:** Build if governing agents is the product you sell; buy if it is a control you need, because the approvals, credential handling, isolation, audit and scanning below are a standing programme of work rather than a one-off project.

## What a build has to deliver

Whichever route you take, a governed agent workforce needs each of these. Treat it as a checklist for your own estimate.

- Approvals that agents cannot grant themselves, with refusals recorded.
- Credentials kept away from agents, with a response when one leaks.
- Isolation between teams or customers that holds even when application code is wrong.
- An audit trail a reviewer can read without engineering help.
- A path to production that verifies work before a human is asked to approve it.
- Vulnerability, secret and supply-chain scanning that reports real findings.
- Spend visibility and limits per agent.
- Identity integration with your directory.

## What Nerve ships for those items today

- An agent can ask to deploy; it can never approve its own request.
- Every blocked attempt is audited.
- Agents never hold provider credentials; the platform performs the privileged action on their behalf.
- When a credential appears in an agent’s output, the stream is cut and a rotation gate opens.
- Tenant isolation is enforced at the database and fails closed: even the database owner role cannot read another tenant’s rows.
- Nerve keeps an admin and chat audit trail.
- The real build and full test suite must pass before the approval gate opens; a failing build never merges.
- Nerve runs real vulnerability scanning, including dependency CVEs, SAST and secret detection, on every tenant, not mock findings.
- Nerve shows cost per agent and per model, with daily trends.
- Budgets warn and then pause for a human.
- Nerve supports OIDC single sign-on and SCIM 2.0 provisioning.

## Where buying is not the answer

- Nerve is not self-hosted by default, and it does not currently offer a fully air-gapped deployment.
- Nerve is a managed service by default; on-premises is available for enterprise customers at significant cost.
- AWS is the one live production deployment target today; other cloud providers are not yet validated against live infrastructure.

## How to decide

- Price the checklist above for your own team using your own salaries and timelines, then compare it with a quote. Book an assessment if you want to talk it through.

Book an assessment: https://dubhlan.com/waitlist?ref=assessment

## Related

- [The cost of ungoverned AI agents](https://dubhlan.com/answers/cost-of-ungoverned-agents)
- [What Nerve does and does not do](https://dubhlan.com/answers/what-nerve-does)
- [Nerve compared with alternatives](https://dubhlan.com/answers/compare)

Canonical page: https://dubhlan.com/answers/ai-agent-governance-build-vs-buy