# Policy Enforcement and Tamper-Evident Audit Chains | ​Imran Siddique | MCP Release Party - Seattle

## Executive summary

This session introduces cMCP, an open-source gateway designed to enhance Model Communication Platform (MCP) security by enforcing policies and creating tamper-evident audit chains. While existing governance tools like the Agent Governance Toolkit (AGT) manage policy application, cMCP addresses the critical gap of ensuring that the governance mechanism itself—including policies and logs—cannot be tampered with. The solution leverages Confidential AI principles, running core components within hardware enclaves to guarantee verifiability for regulated industries.

## Key takeaways

- Beyond Governance: Verifiable Trust: The focus is shifting from merely having policies (governance) to proving that the governance itself has not been tampered with. This requires bringing critical elements into a confidential enclave, ensuring verifiable audit trails and policy integrity.
- cMCP Gateway Functionality: cMCP acts as an open-source gateway wrapping any MCP server without requiring changes to the underlying system. It enforces policies (like Cedar) before every tool call and chains all actions into a tamper-evident record.
- Standardized Audit Trail (Trace): The concept of 'Trace' is being standardized to provide an absolute, verifiable record of system state, including the model ID, policy hash, machine state, and all actions taken. This verification relies on hardware guarantees.

## Technical details

- cMCP Gateway: An open-source gateway that wraps existing MCP servers to enforce policies (e.g., Cedar) before every tool call and generates a tamper-evident record, without requiring modifications to the original server.
- Confidential AI & Enclaves: Critical components (like policy evaluation) are moved inside hardware enclaves (TEE) to prevent tampering. This ensures that even if an agent or attacker gains access outside the enclave, they cannot modify the policies or audit logs.
- Policy Enforcement & Audit Chains: The system verifies not only the action but also the integrity of the policy itself. If a policy is tampered with (e.g., changing an explicit limit), the verification process detects the mismatch between the approved bundle hash and the current state.
- Trace Standard: A standardized format for logging all system interactions, including model ID, policy hash, machine state measurements, and actions taken. This record must be verifiable by external attestation services (e.g., Azure or Google).

## Practical implications

- For regulated industries, the ability to generate an immutable and verifiable audit report (Trace) is critical for compliance.
- cMCP allows organizations to deploy agents and MCP servers securely without needing to rewrite or modify existing infrastructure.
- The concept extends beyond MCP to secure Agent-to-Agent (A2A) communication and model provenance.

## Topics

AI Governance, Confidential Computing, Policy Enforcement, Audit Logging, Microservice Communication, Agent Governance Toolkit, agentrust-io

Source: https://www.youtube.com/watch?v=ynodEQABIJk