MCP Agent Sessions and Governance

Connecting an AI agent to a data platform raises two questions at once: what is it doing, and what is it allowed to do. This concept answers them on two screens that share a section of the navigation. The first is an operational log of agent activity in the workspace; the second is the permission surface that defines the boundary the log is measured against. Both treat agents as callers with identities rather than as a special integration bolted to the side.

The sessions page is headed Agent Sessions and described as the connected clients in this workspace. Four cards count active sessions, tool calls in the last day, tools available and calls blocked by permissions, all sample figures. A Recent Tool Calls table is the substance: timestamped rows naming the session and the acting person, the tool invoked, the target it acted on, the result and the duration. The sample rows read like a working afternoon, with a model version published, an entity created, a saved query run and a data source transitioned, each succeeding in anything from under a hundred milliseconds to a couple of seconds. The last row is different, highlighted and marked as blocked pending confirmation, showing a delete attempt from a script-driven session that did not go through. Selecting a row fills a session detail panel with the client, the acting user, the workspace, the transport in use and the number of tools granted, and a Generate Access Token action sits at the top for connecting a new client.

The governance page answers the second question. Cards count the tools exposed, how many are read-only and how many are classified as destructive, which is the ratio a reviewer cares about most. A tool permissions table lists each tool with its type, whether it requires confirmation and which agents it is granted to, mixing read, execute, write and destructive operations in one place so the shape of the exposure is legible in a single pass. An enforcement path diagram runs from the agent through a workspace gateway that checks permissions and a federation layer that scopes to the workspace, down to the data source, with a line stating that the route is identical for human and agent callers.

An open gaps panel beside the table keeps the design's own governance to-do list in view, naming confirmation on destructive tools as the issue to close. Together the two screens make agent activity legible and bounded: the tools an agent calls are the same modeling, query and source operations people use, and the enforcement path shows those calls passing the same permission check and workspace scoping as a person's.