Scaling agents
Going from one team to the whole company.
Agent pilots almost always work. What breaks is the rollout — when every team needs the same capability, and nobody can say what all of it is allowed to touch.
The problem
Pilots work. Rollouts are where it breaks.
None of these are AI problems. They are the ordinary problems of giving a lot of people access to a lot of systems — which is why they need an ordinary answer.
Every team wires it up again
The pilot worked because a few people sat in one room. Ten teams later, each one has its own integration, its own credentials and its own idea of what good looks like.
Access becomes a ticket queue
Someone joins, someone moves team, someone leaves. If entitlements live in a spreadsheet rather than your directory, that work never stops and never quite catches up.
Nobody can answer for the whole
Each team can describe its own agents. No one can say what every agent in the company is able to reach, which is the question that stops a rollout.
Ten teams later
The same rollout, run two ways.
Nothing here is about the agents getting better. It is about whether the tenth team costs the same to onboard as the first.
Per-team wiring
- Each team integrates its own servers and holds its own credentials
- Access requests arrive as tickets and go stale
- Every team invents its own idea of what is allowed
- No one can say what all the agents can reach
- The tenth team costs as much to onboard as the first
One governed connector
- Capabilities published once as Packs and installed by the teams that need them
- Entitlement follows the directory groups you already maintain
- Rules travel with the capability into every space
- One view across every space, agent and server
- The tenth team is an install, not a project
Packs
Publish once. Install everywhere.
The unit that makes scale possible is not the server or the agent. It is the capability — bundled, named and reusable.
Capabilities, not servers
Nobody wants the salesforce-mcp-v3 server. They want CRM tools. A Pack is that translation — curated tools and Skills under a name a person recognises.
Built once by the people who should build it
Your platform team assembles a Pack. Consuming teams install it. That split is what stops governance becoming a bottleneck at ten teams, or a fiction at a hundred.
Installed into many spaces
One Pack serves as many teams as need it. A Pack is the image; a space is the running instance, with its own identity, policies and lifecycle stage.
Versioned, so rollout is a decision
Packs carry versions. You choose when a team moves, instead of discovering that something changed underneath a working agent.
We see almost every company building in this space. Most are building MCP gateways for engineering teams of five or ten. Palma is a governance layer designed for enterprise scale and enterprise processes … which is why we did not just invest, we run it ourselves.
People and teams
Entitlement that keeps up with the org chart.
Users, teams and provisioning in one place. Access comes from the groups your directory already maintains, so growth is a directory change rather than a configuration project.
- SCIM provisioning and just-in-time user creation
- Teams carry their own membership and spaces
- SSO against Entra, Okta or any OIDC provider
Governance at scale
One answer to what everything can reach.
The rules are attached to the capability, so they arrive with it — in every team that installs it, without being renegotiated each time.
Entitlement follows the directory
Access is driven by the groups you already maintain, with SCIM provisioning and just-in-time user creation. Joining a team grants the tools; leaving removes them.
Policies scoped to the Pack
Approve a capability once and its rules travel with it into every space that installs it — instead of being re-argued per team.
One view across every team
Spaces, agents, servers and tool calls in a single place, so the question "what can everything reach" has one answer rather than twelve.
Book a demo
See what governed AI agents look like.
A 20-minute demo on your stack. We'll show Palma working with the agents, tools and identity provider you already run.
- Enterprise security
- Role-based access
- Instant integration
Latest Blog Posts
Stay up-to-date with the latest in enterprise AI, MCP servers, and secure integration strategies.
