What are Agent Plugins and why do they matter to AI agents?

An AI agent can generate a reasonable security policy from general knowledge. The problem arises when you ask him for something more useful:

• What controls are still uncovered in my organization?

• ce vendors au risc ridicat?

• Who needs to sign a document?

• What evidence is missing for a check?

• What access should be reviewed before the audit?

Without access to the actual state of the organization, the agent guesses.

AMCP server solves part of the problem: it gives the agent Tools and DataBut the data alone doesn’t necessarily tell the agent how to perform a compliance process correctly. Agent Plugins.

Two pieces that need to work together

The Agent Plugins model clearly separates two things:

1. Tools — the operations that the agent can perform and the data to which it can access, for example through MCP.

2. Skills operational instructions that tell the agent how to address a task, what steps to follow and how to show an acceptable outcome.

A simple analogy:

• MCP is the toolkit;

• Skill is the working process.

• The plugin packages them in a form that a compatible client can understand.

An agent with tools, but without method, can change things without context.A agent with good instructions, but without tools, can only provide general recommendations.

The combination becomes useful when the agent can Read the actual state, apply a method and propose a verifiable action..

What an Agent Plugin Usually Contains

The emerging standard uses a small and easy to inspect structure. In the basic form, you encounter three pieces:

• plugin.json – the identity and metadata of the plugin;

• skills/ – instructions for tasks that the agent knows how to perform;

• mcp.json — configuration of the MCP servers and available tools.

The important thing is that skills and MCP are distributed together. You stop installing a set of prompts separately and then try to guess which server or which tools match them.

Why does it matter for compliance?

Compliance is an area where generic responses have limited value.

“You must have access control” is true for almost every organization.

• What administrative accounts are there now?

• What applications do not use SSO?

• cine are acces privilegiat;

• which control of the framework covers that process;

• which evidence is already available;

• which exceptions have been granted;

• Who is the owner of the remedy?

An agent connected to real data can answer these questions. A good skill can force him not to skip context, ownership, evidence and risk treatment.

This changes the role of AI from “text generator” to Controlled Operational Assistant.

Un exemplu: access review

Suppose you want to prepare an access review campaign.

Without tools, the agent can give you a checklist.

With MCP, the agent can get access to users, sources, and campaigns.

With a specific skill, the flow can become:

1. identify the relevant sources;

2. Identify people and roles.

3. separates ordinary access from privileged access;

4. mark the entries that require a decision;

5. propune approve, revoke sau escalate;

6. cere confirmarea unui reviewer uman;

7. Keep the result in the system as evidence.

Skill doesn’t have to replace the revisor, it has to help him make a good decision faster.

Un alt exemplu: policy drafting

A LLM can easily write a generic vendor management policy.

An agent connected to the system could instead:

• Read the actual list of third parties;

• see their risk classification;

• identifica procesele deja existente;

• check which controls and measures are mapped;

• prepare a draft that reflects the actual organization;

• Send the document for review, not directly for publication.

The difference is huge: the document no longer describes an imaginary company.

What does not meet the standard

Agent Plugins is not a “universal app store” and there is no guarantee that any plugin will work identically on any client.

The standard does not automatically eliminate problems such as:

• Discovery – how to find the right plugin

• instalare — fiecare client poate avea propriul flow;

• Authentication – access to data must remain secure.

• permissions – the agent should not receive more rights than the user;

• approval – sensitive actions require human control;

• Auditability – the organization needs to know who or what made a change.

Standardization of packaging helps, but does not eliminate safety responsibility.

OAuth and permissions are more important than prompt

If an agent can write on a GRC platform, access design should be treated as seriously as human user access.

Principiul corect este least privilege:

• the session receives only the necessary purposes;

• User permissions remain the upper limit.

• sensitive operations may require approval;

• actions must be logged;

• The tokens must have a clear life cycle and revocation.

An excellent skill does not compensate for a MCP server that offers too wide access.

Where is ZebraByte positioned

The ZebraByte development area documents integration through GraphQL, MCP, n8n, webhooks and APIThese interfaces allow automation and agents to work with platform data within the limits of available permissions.

A first-party Agent Plugins package is a separate layer over these interfaces. It is not fair to present it as available until it is published and explicitly supported as a product.

But architecturally, the relationship is clear:

Agent / AI client
        ↓
Skill / metodă de lucru
        ↓
MCP / API tools
        ↓
Controls, risks, evidence, vendors, tasks
        ↓
Review și aprobare umană

When to use an agent

The right taskuras are the repetitive and verified ones:

• preparing a list of missing evidence;

• sumarizarea unui access review;

• identification of documents awaiting approval;

• Preparation of a draft policy;

• the initial rating of a vendor for review;

• generate a summary of gap assessment based on existing data.

Taskuras unsuitable for full autonomy are those that change the risk posture or create external commitments without review:

• acceptarea unui risc major;

• publicarea unei politici;

• aprobarea unui vendor critic;

• Declaration of conformity;

• Publishing a commitment in the Trust Center;

• withdrawal of privileged access without operational context.

The Basic Principle

AI becomes much more valuable when it doesn’t have to guess about the organization.

MCP gives him access to reality. Skills gives him the method. Permissions set his limits. Human Review keeps responsibility where it should.

This is the useful idea behind Agent Plugins: Not a “smarter” agent, but a better connected and more restricted agent.

For available surfaces on the platform, see Documentation for Developers and Compliance platform.