Managed service providers (MSPs) can sell AI agent governance as a new assessment finding with a compliance map, then deliver it the same way on every tenant. The commercial opening is not a new product SKU. It is a repeatable managed assessment: discover the agents, put a scope on each integration, and report evidence the client already owes someone else.
This article does not quote partner pricing. Price by tenant in your own model.
The vCISO who found the assistant in finance
A vCISO walked into a quarterly review with an Essential Eight slide and an ISO 27001 statement of applicability. The client’s finance lead then mentioned, as an aside, that the team had connected an assistant to Xero to chase overdue invoices. There was no entry in the asset list, no scope, and no log. The next board pack would have to mention Privacy Act automated decision-making disclosures due 10 December 2026 if the assistant was helping decide who to chase. The vCISO did not need a new framework. They needed a service they could run again at the next tenant on Tuesday.
That is the offer: turn an awkward finding into a packaged control.
Why this is a service now
Because the same three obligations keep showing up, and none of them is owned by the MSP’s existing EDR pack.
Privacy Act ADM (APPs 1.7–1.9 from 10 December 2026). If the tenant is an APP entity and an agent uses personal information to make or substantially help a significant decision, the privacy policy must say so – and stay accurate. See the ADM article.
Essential Eight. The Australian Signals Directorate’s strategies still ask for application control, restriction of administrative privileges, and user application hardening. An unofficial MCP (Model Context Protocol) server on a finance laptop is an unapproved application with a powerful credential.
ISO/IEC 27001. Access control, supplier relationships and logging are already in the statement of applicability. An agent that holds a vendor key is an access-control and supplier-logging gap. Mapping the service to those clauses is not a certification claim. It is a way to write the finding in language the audit already uses.
APRA-regulated tenants add CPS 230 and the April 2026 AI letter. See APRA and CPS 230.
Three service tiers
Discovery, scoping, then monitoring and reporting. Sell them separately or as a ladder.
| Tier | What you do | What the tenant gets | How it repeats |
|---|---|---|---|
| 1. Discovery | Inventory assistants, MCP clients, unofficial connectors and the vendor APIs they call | A register: caller, target, credential owner, decision types, personal information likely used | Same questionnaire and traffic review on every tenant |
| 2. Scoping | Put each in-scope caller behind a proxy: vendor key isolated, default deny, read-only where the job allows, response filters | A written grant per agent and a test that a write or extra object is denied | Same rule patterns (CRM read, Xero invoices, Graph mail) copied per tenant |
| 3. Monitoring and reporting | Watch meters and the audit trail; refresh the privacy-policy and Essential Eight evidence when callers change | A monthly pack: who called what, denies, scope changes, open risks | Same report template, one console, many tenants |
Do not price these from RequestRocket’s list. Price by tenant count, by number of agents, or by the audit cycle you already run.
What a multi-tenant console changes
It makes the ladder a product rather than a hero engagement.
An MSP that governs many client environments from one console can create the next tenant’s proxies from a library, keep client data and audit rows isolated, and let a junior analyst run the monthly pack. Without that, every tenant is a snowflake spreadsheet. The assessment dies when the vCISO who invented it is on leave.
Discovery still needs interviews. Scoping still needs someone who understands the client’s Xero file. The console is what stops those conversations from becoming one-off implementations.
How to run the assessment
- Ask who already connected an assistant. Finance, people-and-culture and the helpdesk before the CISO’s official list.
- Map each caller to a decision and a vendor API. That is the ADM and ISO supplier row.
- Classify blast radius. Owner token in MCP config is urgent. Read-only with a shared key is next.
- Scope the first two callers. Prefer read-only. Record the deny test.
- Write the finding in the client’s language. Privacy policy, Essential Eight application control, ISO A.5 / A.8 access and logging – only the clauses you have mapped with their auditor.
- Put the tenant on the monthly pack. New agents are in-scope events, not anecdotes.
Outbound API governance is the category you are selling, not a brand.
A note on what not to promise. Do not tell the tenant they are “APP 1.7 compliant” because a proxy exists. Do not tell them Essential Eight is complete because one unofficial MCP server was moved behind a rule. Do not put a certification mark on the monthly pack. The service produces evidence those programmes can use. Counsel and the auditor still decide sufficiency.
The same honesty helps the sale. Buyers have heard AI-governance pitches that collapse into a policy PDF. A discovery register, a deny test in a log, and a monthly list of new callers is a different offer. It is also something a junior analyst can run once the first tenant’s patterns exist.
If the MSP already sells vCISO hours, this is a named workpaper, not a new company. If the MSP sells Microsoft 365 or Xero support, the first two scoped callers are usually already in the estate. Start there. Do not wait for a platform-wide AI strategy the client has not written.
A first-tenant runbook that stays honest:
- Week 1: interview finance, support and the identity owner. List unofficial connectors, desktop MCP clients and shared vendor keys. Produce the register.
- Week 2: pick one caller. Move the vendor credential off the laptop. Attach a deny-by-default grant. Run a deny test and keep the log.
- Week 3: map the finding to the client’s existing language (APP 1.7 if a decision is in scope, Essential Eight restriction of privileges, ISO 27001 access control). Send the pack. Do not add a certification claim.
- Month 2 onward: monthly new-caller report, quarterly grant recertification, and a named contact when a vendor key is rotated.
That is a managed assessment. It is not a security operations centre and it is not an AI-safety product. Keep the scope that narrow and the offer stays repeatable.
The first two tenants will feel slow. The third should reuse the questionnaire, the Xero and Graph rule patterns, and the monthly pack. If they do not, the service is still a hero engagement and the pricing will not hold.
Where RequestRocket fits
RequestRocket provides the multi-tenant console, the proxies, the rules, the filters, the meters and the audit trail. The MSP owns the assessment, the mapping and the relationship. RequestRocket does not certify ISO 27001, Essential Eight or Privacy Act compliance. It does not price the MSP’s offer. It does not provide models.
FAQ
Do we need to be a RequestRocket partner to sell this?
You need a way to enforce and evidence the grant. A multi-tenant console is how you repeat it. Partner terms are a commercial conversation, not a prerequisite named in this article.
How do we price by tenant?
Use your existing vCISO or compliance-pack arithmetic: a fixed discovery, a per-agent scoping fee, a monthly monitor. Do not wait for a vendor price list.
Will clients see this as competing with their IAM vendor?
No, if you say so. IAM remains who. You are selling what each call may do on APIs the client does not host.
Can we map this to Essential Eight without over-claiming?
Map the finding to application control and restriction of privileges. Do not claim the eight strategies are “done” because one agent is scoped.
What about clients who only want a report?
Sell tier 1. Be explicit that a register without enforcement will not stay true after the next unofficial connector.
Does this include model safety or prompt policy?
No. That is an AI-gateway or acceptable-use conversation. This service is the outbound API hop.
Book a walkthrough of RequestRocket
Sources
- OAIC, Chapter 1 APP 1 (APPs 1.7–1.9)
- APRA, Letter to Industry on Artificial Intelligence (30 April 2026)
- ASD, Essential Eight
- ISO/IEC 27001 (standard; clause mapping is illustrative, not a certification)