Intercept
The call arrives at a mediated seam. Which seam it is determines which outcomes are available — an SDK consult path can return a decision but cannot receive a rewritten payload back.
Platform / Architecture
Four tiers, one decision path, and a loop that closes.
Eleven platform pages describe what each capability does. This one is the single view: where GovernorAI sits relative to your agents and your clouds, what happens on one governed call, and what happens after the call — when someone changes a control in a cloud console and the policy you deployed is no longer the policy that is running.
Decision path, end to end Drift detected and reconciled Shadow by default
THE STACK
Where the control plane sits.
Two planes, deliberately separated. The decision runs next to the agent; the management of policy and evidence runs centrally. A control plane outage must not become an enforcement outage.
Tier 1Not trusted. Governed, not modified.
The agents you already run
GovernorAI does not ask you to rebuild an agent, change a framework or adopt a runtime. It attaches at the seam where the agent's intent becomes a real call — a tool invocation, an MCP call, a model request.
LangChainCrewAIBedrock AgentsAzure AI FoundryVertex AIMCP serversYour own code
↓ the call reaches a mediated seam
Tier 2Your environment. In the decision path.
Enforcement point
The component that returns a decision before the action is dispatched. Seven seams exist and they do not all enforce the same things — the capability matrix that says which outcome each seam can truthfully execute lives in the product source, not in a slide.
OPA / RegoNo model in the loopNo-match denyKill switchSession limits
↓ decision and evidence, asynchronously
Tier 3SaaS or self-hosted. Offline-tolerant; self-hosted control plane scoped per engagement.
Control plane
Where policy is authored, versioned and distributed, where approvals are resolved by a human, and where the evidence record is assembled and sealed. It is out of the hot path by design: it manages enforcement, it does not perform it.
Policy storeApprovalsEvidence indexAudit trailFleet view
↓ compiled policy, synced where a provider client is configured
Tier 4Your cloud accounts. Native controls.
Provider-native enforcement
For the three model providers with a guardrail format, the same policy compiles into that provider’s own configuration — a declarable artefact you apply in your own account, where the control then runs whether or not a GovernorAI component is reachable. Pushing that artefact, and reconciling it afterwards, needs a configured provider client; the shipped control plane wires none by default.
AWS Bedrock GuardrailsAzure OpenAI RAI policyVertex AI / Model Armor
Tier 4 exists for the three providers that expose a declarative guardrail format. Salesforce, ServiceNow and MCP or agent-framework calls have no such format: they are governed at runtime in Tier 2 instead, and the multi-cloud page states which is which rather than implying uniform coverage.
ONE CALL
What happens between intent and consequence.
The same path every time, in the same order. Nothing here consults a model.
Identify
Agent, session and the policy bound to them are resolved. Session limits and any active kill switch are checked here, before evaluation.
Evaluate
Rego is evaluated deterministically. The governance mode on the policy decides what the result is permitted to do: audit_only, shadow, learning or enforcement.
Decide
One of six outcomes. allow, deny, pause for human approval, or the three shaping outcomes — redact, mask, constrain. A kill switch can stop an agent outright, but it is a separate control rather than a seventh outcome, and the capability matrix does not list it as one.
Verify or deny
If the decision shapes the payload, the shaped payload is re-checked against what will actually be sent. Shaping that cannot be applied cleanly fails closed to deny rather than forwarding something half-rewritten.
Record
A structured decision event is written — the inputs as a hash, the matched policy and rule, when one matched, the outcome and the reason. Not the prompt, and not the model output.
The three shaping outcomes are the reason this is not a gate. A gate has one answer for a call it does not like, and that answer stops the agent. Narrowing an argument, masking a field or redacting a value lets the work continue with the dangerous part removed — which is what a pilot blocked on a security review actually needs.
THE LOOP THAT CLOSES
The drift problem, and how far we have built for it.
Deploying a control is the easy half. The half that decides whether governance is real is what happens when that control is changed out from under you. The engine below is implemented and tested. Read it as design that can be inspected, not as a capability running in your estate today — the qualification under the table is the important part.
Stage
What the reconciliation engine is built to do
Observe
On each cycle it fetches the live configuration of the resource it recorded and hashes it, then compares that hash against the hash of what was generated. Equal hashes mean no drift and the job is left alone.
Check ownership
If the resource carries an ownership marker naming a different transpilation, reconciliation is skipped and logged. GovernorAI will not seize a resource it does not own — including one owned by a different GovernorAI policy.
Act, by mode
In shadow mode the job is marked
drifted and a transpilation.drifted audit event is emitted. Nothing in your cloud is touched. In enforce mode the deployed configuration is rewritten back to the compiled policy, the job returns to verified, and a transpilation.reconciled event records the observed hash, the target hash and the fact that an overwrite occurred.Contain failure
Each provider has its own circuit breaker. A cloud that starts failing is skipped after repeated consecutive failures and retried after a reset interval, so one unreachable provider cannot starve reconciliation for the others. A panic on one job is caught and accounted as that job's failure; the cycle continues.
Skip the stuck
A job whose state has not advanced past a staleness threshold is skipped rather than retried indefinitely.
TOPOLOGY
Where each tier can run.
The separation in the stack above is what makes these choices independent of each other.
Deployment
What it means for the decision path
Sidecar
The enforcement point runs on the agent's own host. The decision never crosses the network, which is the only topology the published latency figure covers.
Gateway
A shared enforcement service in your VPC. One place to operate, at the cost of a network hop on every governed call.
In-cloud, compiled
No GovernorAI component in the path at all. The policy is compiled into the provider's native guardrail, which lives in your account once it is applied, and the provider enforces it where you attach it to the model call. Applies to the three providers in Tier 4.
Self-hosted control plane
Tier 3 runs in your infrastructure rather than ours. Independent of which Tier 2 topology you chose.
A latency number is only meaningful next to the topology that produced it. The benchmark page states its conditions before its results, and says plainly which rows are not yet measured.
WHAT THIS PAGE DOES NOT CLAIM
The parts an architect will ask about.
Question
Answer
Do all seven seams enforce the same outcomes?
No, and the product does not pretend otherwise. The capability matrix is data in the source, its own comment states that anything not listed cannot be claimed, and choosing an outcome a seam cannot execute downgrades to deny rather than silently passing.
Is there a published p99?
Not yet. A load harness exists and the threshold it enforces is a p99 under 100 ms with an error rate under one percent. A lower figure appears in the harness as a design target. This site does not print a target as though it were a result.
Is the audit trail a Merkle tree?
On the batch evidence path, yes — a binary SHA-256 tree over the canonical bytes of each record. One bundle path currently records a flat content hash in the same field. Ask which path produced the bundle you are reviewing.
How many clouds compile?
Three. AWS Bedrock, Azure OpenAI and Google Vertex. Additional push targets exist for Kubernetes, Envoy and a GCP edge, but a push target is not a guardrail compiler and is not counted as one here.
What is logged?
Structured decision events carry a hash of the arguments, the policy that matched, the outcome and the reason. Approval requests keep the arguments a person is asked to approve.