---
title: "Update"
method: POST
path: "/api/v1/settings/ai-governance"
tags: ["AI Governance Settings"]
---

# Update

`POST /api/v1/settings/ai-governance`

Update the tenant's AI governance settings. Requires update_mask listing
 which fields to apply (e.g. require_tool_approval,
 default_tool_classification, audit_verbosity, auto_discovery_enabled,
 discovery_interval, prefer_code_mode_over_direct_tools,
 surface_requestable_tools, untrusted_judge_disable, allowed_client_types,
 default_client_lifecycle).
 Only masked fields change. Returns the updated settings.

## Request body

- C1ApiAiGovernanceV1UpdateAIGovernanceSettingsRequest — UpdateAIGovernanceSettingsRequest is the request to update the tenant's AI governance settings.
  - `aiGovernanceSettings` C1ApiAiGovernanceV1AIGovernanceSettings — AIGovernanceSettings holds the tenant-wide AI governance policy that controls MCP client access, tool approval, classification defaults, audit detail, and automatic tool discovery. There is one settings object per tenant.
    - `allowedClientTypes` string[], nullable — MCP client types permitted to connect. An empty list allows all types.
    - `auditVerbosity` 'AUDIT_VERBOSITY_UNSPECIFIED' | 'AUDIT_VERBOSITY_MINIMAL' | 'AUDIT_VERBOSITY_STANDARD' | 'AUDIT_VERBOSITY_FULL' — How much detail is captured in the audit log for MCP tool calls.
    - `autoDiscoveryEnabled` boolean — When true, C1 periodically re-discovers tools from registered MCP servers on the discovery_interval schedule.
    - `c1awAutospillDisabled` boolean — Deprecated. Set QUOTA_REF_TENANT_C1AW_AUTOSPILL_THRESHOLD_KB to 0 to disable C1AW autospill.
    - `c1awAutospillThresholdBytes` integer — Deprecated. C1AW autospill is configured with QUOTA_REF_TENANT_C1AW_AUTOSPILL_THRESHOLD_KB.
    - `codeModeConcurrency` integer — Number of pre-warmed Lambda instances for the per-tenant code-mode function. 0 (default) leaves the Lambda cold-started on first call; > 0 keeps that many execution environments warm via AWS Lambda provisioned concurrency, redeploying the function on change.
    - `createdAt` string, date-time, nullable
    - `defaultClientLifecycle` C1ApiAiGovernanceV1MCPClientLifecycleConfig — MCPClientLifecycleConfig controls how long inactive MCP clients remain visible, when their access is closed, and when their records are removed. Durations are measured from the client's last activity. Any duration left at zero disables that transition.
      - `inactivityCloseAfter` string, duration, nullable
      - `inactivityHideAfter` string, duration, nullable
      - `retentionDeleteAfter` string, duration, nullable
    - `defaultToolClassification` 'TOOL_CLASSIFICATION_UNSPECIFIED' | 'TOOL_CLASSIFICATION_READ' | 'TOOL_CLASSIFICATION_WRITE' | 'TOOL_CLASSIFICATION_DESTRUCTIVE' | 'TOOL_CLASSIFICATION_SENSITIVE' | 'TOOL_CLASSIFICATION_DANGEROUS' — Classification assigned to newly discovered tools that do not declare their own classification (for example, read, write, or destructive).
    - `discoveryInterval` string, duration, nullable
    - `enabled` boolean — Legacy master switch.
    - `preferCodeModeOverDirectTools` boolean — When true, the MCP server hides direct tool listings from capable clients whenever the code-mode entrypoints (describe + execute) are registered, so agents discover and invoke MCP tools through TypeScript code mode instead of direct tool calls. A small allowlist of high-traffic direct tools remains exposed. Incapable clients (e.g. SERVICE, EPHEMERAL) see the normal tool set regardless. Defaults to false.
    - `requireToolApproval` boolean — When true, newly discovered tools start in a pending state and must be approved by an admin before they can be granted or invoked.
    - `surfaceRequestableTools` boolean — When true, MCP discovery surfaces tools the caller could request (no active grant, but reachable through a request catalog) alongside granted tools — both on the classic tools/list path and inside the code-mode describe entrypoint. Invoking such a tool opens (or reuses) an access-request ticket and returns a request_created envelope instead of executing. Defaults to true.
    - `untrustedJudgeDisable` boolean — When true, the A2 (untrusted-content) judge is skipped and the untrusted dimension always scores LOW. When false (the default), the judge scores agent turn input and tool output for prompt-injection risk on every turn. Defaults to false, so the judge runs by default.
    - `updatedAt` string, date-time, nullable
  - `updateMask` string, nullable

## Response `200`

UpdateAIGovernanceSettingsResponse contains the updated AI governance settings.

- C1ApiAiGovernanceV1UpdateAIGovernanceSettingsResponse — UpdateAIGovernanceSettingsResponse contains the updated AI governance settings.
  - `aiGovernanceSettings` C1ApiAiGovernanceV1AIGovernanceSettings — AIGovernanceSettings holds the tenant-wide AI governance policy that controls MCP client access, tool approval, classification defaults, audit detail, and automatic tool discovery. There is one settings object per tenant.
    - `allowedClientTypes` string[], nullable — MCP client types permitted to connect. An empty list allows all types.
    - `auditVerbosity` 'AUDIT_VERBOSITY_UNSPECIFIED' | 'AUDIT_VERBOSITY_MINIMAL' | 'AUDIT_VERBOSITY_STANDARD' | 'AUDIT_VERBOSITY_FULL' — How much detail is captured in the audit log for MCP tool calls.
    - `autoDiscoveryEnabled` boolean — When true, C1 periodically re-discovers tools from registered MCP servers on the discovery_interval schedule.
    - `c1awAutospillDisabled` boolean — Deprecated. Set QUOTA_REF_TENANT_C1AW_AUTOSPILL_THRESHOLD_KB to 0 to disable C1AW autospill.
    - `c1awAutospillThresholdBytes` integer — Deprecated. C1AW autospill is configured with QUOTA_REF_TENANT_C1AW_AUTOSPILL_THRESHOLD_KB.
    - `codeModeConcurrency` integer — Number of pre-warmed Lambda instances for the per-tenant code-mode function. 0 (default) leaves the Lambda cold-started on first call; > 0 keeps that many execution environments warm via AWS Lambda provisioned concurrency, redeploying the function on change.
    - `createdAt` string, date-time, nullable
    - `defaultClientLifecycle` C1ApiAiGovernanceV1MCPClientLifecycleConfig — MCPClientLifecycleConfig controls how long inactive MCP clients remain visible, when their access is closed, and when their records are removed. Durations are measured from the client's last activity. Any duration left at zero disables that transition.
      - `inactivityCloseAfter` string, duration, nullable
      - `inactivityHideAfter` string, duration, nullable
      - `retentionDeleteAfter` string, duration, nullable
    - `defaultToolClassification` 'TOOL_CLASSIFICATION_UNSPECIFIED' | 'TOOL_CLASSIFICATION_READ' | 'TOOL_CLASSIFICATION_WRITE' | 'TOOL_CLASSIFICATION_DESTRUCTIVE' | 'TOOL_CLASSIFICATION_SENSITIVE' | 'TOOL_CLASSIFICATION_DANGEROUS' — Classification assigned to newly discovered tools that do not declare their own classification (for example, read, write, or destructive).
    - `discoveryInterval` string, duration, nullable
    - `enabled` boolean — Legacy master switch.
    - `preferCodeModeOverDirectTools` boolean — When true, the MCP server hides direct tool listings from capable clients whenever the code-mode entrypoints (describe + execute) are registered, so agents discover and invoke MCP tools through TypeScript code mode instead of direct tool calls. A small allowlist of high-traffic direct tools remains exposed. Incapable clients (e.g. SERVICE, EPHEMERAL) see the normal tool set regardless. Defaults to false.
    - `requireToolApproval` boolean — When true, newly discovered tools start in a pending state and must be approved by an admin before they can be granted or invoked.
    - `surfaceRequestableTools` boolean — When true, MCP discovery surfaces tools the caller could request (no active grant, but reachable through a request catalog) alongside granted tools — both on the classic tools/list path and inside the code-mode describe entrypoint. Invoking such a tool opens (or reuses) an access-request ticket and returns a request_created envelope instead of executing. Defaults to true.
    - `untrustedJudgeDisable` boolean — When true, the A2 (untrusted-content) judge is skipped and the untrusted dimension always scores LOW. When false (the default), the judge scores agent turn input and tool output for prompt-injection risk on every turn. Defaults to false, so the judge runs by default.
    - `updatedAt` string, date-time, nullable

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)