MCP DevOps Governance Rollout Kit

# Transport policy matrix (example)

| Action Tier | Default Transport | Allowed Remote? | Extra Controls Required |
|---|---|---|---|
| Tier 1 (read-only) | stdio or streamable-http | Yes | auth, logging, rate limits |
| Tier 2 (reversible write) | stdio preferred | Yes, after review | authz scopes, owner routing, audit logs |
| Tier 3 (infra mutation) | stdio for pilot; CI executor for prod | Limited | human approval, change record, least privilege, rollback path |
| Tier 4 (destructive/prod critical) | no direct agent execution by default | Exceptional only | break-glass workflow, multi-party approval, recorded session |

Rule of thumb:
- Use stdio when reducing network exposure and keeping credentials local matters most.
- Use streamable HTTP when shared services, central policy, and auditability matter most.
- Never let transport choice be the only control. Transport is one layer, not the policy.

# Approval policy pattern (conceptual)

policies:
  - name: tier1-read-only
    match:
      server: ["billing", "inventory", "docs", "metrics"]
      actionTier: [1]
    effect: allow
    requirements:
      - log_to_siem

  - name: tier2-reversible-writes
    match:
      actionTier: [2]
    effect: allow_with_conditions
    requirements:
      - log_to_siem
      - owner_scope_check
      - change_ticket_or_issue_link

  - name: tier3-infra-mutation
    match:
      actionTier: [3]
    effect: require_human_approval
    requirements:
      - approved_change_request
      - executor_is_ci_or_control_plane
      - plan_or_dry_run_artifact
      - rollback_path_documented
      - log_to_siem

  - name: tier4-destructive
    match:
      actionTier: [4]
    effect: deny_by_default
    exceptions:
      - break_glass_runbook
      - multi_party_approval
      - recorded_session