Govern
What are the Govern tools for?
Nineteen MCP tools for budgets, teams, tagging policies, smart tags and audit logs. Twelve read; five sit at tier 1 (metadata only) and two at tier 2. Roles, user management, credentials and cloud-account deletion are never exposed at any tier.
Tools
| Tool | Access | Purpose |
|---|---|---|
get_budget_spend | read | Get current-month spend for the entities a budget targets — use this to answer 'how much has account X / this resource / this group spent so far', and to see which targets are tracking over |
get_cloud_account_permissions | read | Get the per-permission IAM probe verdicts for one cloud account — use this to explain WHY discovery or a cost/recommendation feature is missing data, rather than guessing |
get_team | read | Get details of a specific team including member count and resource count |
list_audit_logs | read | List API audit log entries showing who did what and when |
list_notification_channels | read | List notification channels (Slack, Teams, Google Chat, webhooks) configured for the organisation |
list_roles | read | List the roles defined in this organisation and the RBAC policies each one carries |
list_smart_tags | read | List smart tags — the tags ZopNight DERIVES for a resource from this org's tagging policies, to fill gaps in the tags the cloud account actually carries |
list_tagging_policies | read | List the tagging policies that govern which tags this org's resources must carry and how each tag's value is derived |
list_team_members | read | List members of a team |
list_team_resources | read | List resources assigned to a team |
list_teams | read | List teams in the organisation |
list_users | read | List all users in the organisation |
accept_smart_tag | write | Accept smart tags on a resource — promote tag keys ZopNight DERIVED from this org's tagging policies into cost attribution |
create_budget | write | Create a monthly spend budget for ONE resource, resource group or cloud account |
delete_budget | write | Delete a budget |
revoke_smart_tag | write | Revoke smart tags on a resource — return accepted tag keys to PENDING, so they stop being used for cost attribution |
update_budget | write | Change an existing budget's monthly amount and alert threshold |
create_tagging_policy | write | Create a resource TAGGING policy — a rule that derives a tag onto this org's cloud resources so their spend can be attributed |
update_tagging_policy | write | Change an existing resource TAGGING policy — its label, its rule, or whether it is on |
What is deliberately not here
Start with the exclusions, because they are the point of this category. No MCP tool at any tier can manage roles or permissions, create or remove users, delete an organisation, delete a cloud account, or read credentials. Those are not gated behind a high tier. They are absent.
An assistant with the highest write tier enabled still cannot escalate its own access.
The three access levels in play
- Read (12 tools):
list_users,list_teams,list_roles,get_team,list_audit_logs,list_smart_tags,list_tagging_policies,list_notification_channels,get_budget_spend,get_cloud_account_permissions. Note the last: it returns the per-action IAM probe verdicts, so an assistant can tell you why a schedule will fail before it does. - Tier 1, metadata only (5):
create_budget,update_budget,delete_budget,accept_smart_tag,revoke_smart_tag. These change ZopNight’s own records. None of them touches a cloud resource. - Tier 2, reversible (2):
create_tagging_policy,update_tagging_policy.
Why budgets are tier 1 and not tier 0
A budget is a ZopNight record, so deleting one destroys no infrastructure. But budgets drive alerting, and an assistant that quietly raised a threshold would suppress the warning a human was relying on. Tier 1 is the smallest gate that makes that a deliberate choice.
Smart tags are proposals, not writes
accept_smart_tag and revoke_smart_tag act on ZopNight’s derived tags, virtual attributions
used for cost reporting. They are never written back to your cloud provider, so accepting one
changes how spend is attributed in reports and changes nothing in AWS, Azure or GCP.
Govern tools: common questions
Can an assistant grant itself more access?
No. No MCP tool at any tier manages roles or permissions, creates or removes users, deletes an organisation or a cloud account, or reads credentials. Those are absent from the surface rather than gated behind a high tier.
Why is creating a budget tier 1 rather than read-only?
A budget is a ZopNight record, so deleting one destroys no infrastructure. But budgets drive alerting, and an assistant that quietly raised a threshold would suppress the warning a human was relying on. Tier 1 is the smallest gate that makes that a deliberate choice.
Does accepting a smart tag write a tag into my cloud account?
No. Smart tags are ZopNight's own derived attributions, used for cost reporting. Accepting one changes how spend is attributed in reports and changes nothing in AWS, Azure or GCP.