# Govern your first agent

> Connect an agent, confirm what its tools do, choose a profile, and see decisions, without writing a rule.

Source: https://docs.atensecurity.com/docs/getting-started/govern-your-first-agent

Thoth governs an agent from its first call. You don't write rules to get
started: you tell Thoth what each tool does, and a profile turns that into
decisions. This page takes one agent from first call to a confirmed policy.

## 1. Connect the agent

Instrument the agent with an SDK or the MCP proxy, as in
[Instrument your own agent](https://docs.atensecurity.com/docs/getting-started/your-agent). Every tool call
now goes through Thoth before it runs.

Until you confirm a tool's effects, Thoth treats it as **unconfirmed** and
holds each call for an approver (`STEP_UP`). Unconfirmed never means allowed.

## 2. Review the tools Thoth found

When the agent starts, the SDK or proxy reports its tools: names,
descriptions and input-schema structure. Thoth proposes what each tool does,
from MCP annotations such as `readOnlyHint` and from the tool's name and
arguments.

Proposals are suggestions, not permissions. A tool that describes itself as
read-only is still held until a person confirms it. Set
`THOTH_TOOL_INVENTORY=off` in the agent's environment to stop reporting tools.

List the tools and their proposals:

```bash
thothctl tools list
```

## 3. Confirm what each tool does

Confirming records the tool's effects as a declaration. Only a tenant admin can
confirm, or an approver when the tenant has no admin. A confirmation applies to
the next decision.

```bash
thothctl tools confirm orders.list --classes read
thothctl tools confirm orders.delete --classes delete
```

The same declarations in Terraform:

```terraform
resource "thoth_tool_classification" "read_orders" {
  tool_name = "orders.list"
  classes   = ["read"]
}

resource "thoth_tool_classification" "delete_order" {
  tool_name = "orders.delete"
  classes   = ["delete"]
}
```

A tool can have more than one class. Thoth applies the most restrictive
outcome among them. See [Profiles and action classes](https://docs.atensecurity.com/docs/getting-started/profiles)
for the classes and what each means.

## 4. Choose a profile

Every agent starts on `safe-default`: confirmed reads and writes are allowed,
deletes, external calls and other high-impact actions need an approver, and
sensitive data cannot leave your system. Choose a profile that adds rules for
your kind of agent:

| Profile | Adds |
| --- | --- |
| `coding-agent` | Approved Git remotes, production releases, secrets files |
| `finance-operations` | Vendor bank details, large payments, new payees |
| `customer-support` | Large refunds, customer data leaving, account deletion |

Choose at trial signup, or with the CLI or Terraform:

```bash
thothctl init --agent-id my-agent --profile coding-agent
```

```terraform
resource "thoth_pack_assignment" "my_agent" {
  agent_id        = "my-agent"
  pack_id         = "coding-agent"
  profile_version = "1.0.0"
}
```

A trial uses one profile for the whole workspace. On a paid plan, each agent
can use its own profile, and admins can change its parameters, such as the
payment approval amount.

## 5. See the decisions

Call each tool. With `coding-agent` and the declarations above:

| Call | Decision |
| --- | --- |
| `orders.list` (read) | `ALLOW` |
| `orders.delete` (delete) | `STEP_UP`: an approver decides |
| A tool you haven't confirmed | `STEP_UP` |

Each decision names the rule that matched, and the profile and version, in its
reason, its signed receipt and the dashboard. Use
[`/v1/explain`](https://docs.atensecurity.com/docs/api-reference/explain) for a plain-language explanation of
any refusal.

## What changes later

- **Profile versions are pinned.** When a profile improves, your agents stay on
  their current version until an admin approves the update.
- **Removing a profile** returns the agent to `safe-default`. `safe-default`
  itself can't be removed.
- **If model scoring is unavailable,** confirmed profile `ALLOW` decisions still
  apply where your deployment enables it, and unconfirmed tools still need an
  approver.