Platform / Integrations

Does it meet the stack you already run?

GovernorAI governs agents it did not build, on infrastructure it does not own — so every integration here is an insertion point into something you already operate, not a platform you are asked to move onto.

Nothing required inside the agent You keep the credentials Fail-closed gateway adapters

ENFORCEMENT SEAMS

Where the decision is applied.

If a gateway already sees the call, that is where the decision goes. Each adapter is a thin protocol translator: it parses the tool call off the wire, builds the canonical execute request, and expresses the verdict in that protocol's own terms.

01Gateway and proxy adapters

Seam

How the decision is applied

Adapter

Envoy ext_proc

Envoy Gateway, Istio, Gloo, Envoy AI Gateway and agentgateway. Allow continues, redact becomes a body mutation, pause returns 202, deny returns 403. failure_mode_allow: false is required.

governor-extproc · :9002 gRPC

Transparent MCP proxy

No gateway required at all — point the MCP client's server URL at the proxy, or chain it inside an existing one. tools/call is governed; initialize, tools/list, ping and notifications pass through untouched.

governor-mcp-proxy · :9003 HTTP

HTTP forward-auth

NGINX auth_request, Traefik ForwardAuth, an AWS Lambda authorizer, Apigee or Azure APIM. Allow returns 200, deny returns 403. This pattern cannot rewrite a body.

governor-checkgw · :9004 HTTP

SDK / function wrap

Wrap the call in a few lines. You keep the credentials, the tool code and the control flow — GovernorAI is not a proxy in front of your model provider.

thin client

02LLM gateways — governing the model call itself

LLM gateway

How GovernorAI attaches

Governs

Portkey

Registers as a webhook check on the gateway you already run.

the model call

LiteLLM

Registers as a CustomGuardrail.

the model call

Envoy AI Gateway

Registers as an ext_proc filter.

the model call

The gateway keeps the provider credentials, the connection and the retry behaviour. GovernorAI registers as a guardrail on the gateway that is already there and answers a question; it does not sit in the token path.

PLATFORMS

Named platform coverage.

Each of these has a page describing exactly what is and is not governed at that seam.

Platform

Coverage

Seam

AWS Bedrock

Inbound seam; guardrail sync with a configured AWS client. End-to-end shaped arguments returned to an inbound self-execute caller are materialized for this seam today; generalizing that gate is tracked work.

inbound

Salesforce

Native action gate: Agentforce, Flow and Apex ask for a decision before the action runs, and Salesforce executes the authorized operation. Agents outside the org use the governed API route, which checks the request before it reaches Salesforce and forwards it only on allow.

in-org gate · API route

ServiceNow

Workflow check: a Flow Designer action asks for a decision before the step runs. A before-write rule on the record table aborts a denied write before it commits. Discovery reads the instance; it observes, it does not block.

in-instance

Databricks

Model Serving proxy before the model call; cluster egress checks each outbound connection before it opens, pinned by cluster policy at create; the agent SDK decides before the tool acts, including Unity Catalog functions.

proxy · egress · SDK

Model Context Protocol

Registry, transparent proxy and argument-aware inspection.

proxy

DISCOVERY SOURCES

Where unregistered AI activity shows up.

The discovery surface is derived from live wiring, so it cannot claim a source the backend cannot actually ingest.

01Agent frameworks

Framework

How it appears

Method

LangChain / LangGraph

Framework runtime installs that group many agents under one process.

registered

CrewAI

Framework runtime install, grouped under one process.

registered

n8n

Framework runtime install, grouped under one process.

registered

Framework runtimes are registered rather than found: an operator declares them, or they heartbeat themselves in. A framework install groups many agents under one process, so it is counted once, not once per agent.

02Identity and consent

Source

What it surfaces

Signal

Okta

System Log — OAuth grants and application sign-ins to AI apps.

consent · sign-in

Microsoft Entra ID

Directory audit events.

consent · sign-in

Google Workspace

Admin Reports API.

consent · sign-in

03SIEM, log and telemetry

Destination

Parsing contract

Direction

Splunk

HTTP Event Collector, including the batched newline-delimited stream: the event envelope is unwrapped and indexed fields merged.

ingest

Microsoft Sentinel

Azure Monitor / Log Analytics common-schema columns, with both the records export and value query envelopes unwrapped.

ingest

Datadog

Logs intake, decomposing ddtags into user, host and env dimensions and reading the nested attributes object.

ingest

Generic SIEM webhook

Webhook delivery for anything not named above; plain log lines are also accepted.

ingest

OpenTelemetry

Metrics under a single namespace — governor.request_count, governor.request_latency, governor.policy_evaluation_duration.

export

DECLARE AND OPERATE

Policy as a reviewed artifact.

Surface

What it does

Form

Terraform provider

Declare policy as a reviewed artifact rather than a console setting.

declarative

Remote OPA

One policy, from intent to evidence; GovernorAI does not require its own.

per deployment

LLM GATEWAYS

How each LLM-gateway adapter attaches and answers.

The gateway keeps the provider credentials, the connection and the retry behaviour; GovernorAI answers a question it is asked. Endpoints and on-allow, on-deny behaviour per adapter.

Adapter	Attaches to	On allow	On deny, pause or error
Portkey webhook	`POST /v1/portkey/guardrail` — a Bring Your Own Guardrail check on the before- and after-request hooks. Config only; no code on the Portkey side.	`verdict:true`, with a redacted body returned as `transformedData` when Portkey sends the structured JSON.	HTTP 200 with `verdict:false` — never a 5xx.
LiteLLM guardrail	`POST /v1/llm/check` through `governor_guardrail.py`, wired at `pre_call`, `during_call` and `post_call`.	`allow:true`, with `transformed_messages` or `transformed_response` when content was shaped.	`allow:false` carrying `fail_closed`. The shim blocks on an outage unless `fail_open` is deliberately set.
Envoy `ext_proc`	Envoy Gateway, Istio, Gloo, Envoy AI Gateway, agentgateway — gRPC on `:9002`.	`CONTINUE`; a redaction is applied as a body mutation.	Pause returns 202, deny returns 403. `failure_mode_allow: false` is required.
Forward-auth	NGINX `auth_request`, Traefik, Apigee, Azure APIM, Lambda authorizer.	200.	403. This pattern cannot rewrite a body — it emits `X-Governor-Shaping-Required: true` so the operator knows shaping was requested but not applied.

portkey · webhook guardrail response

# allowed, with the prompt rewritten by inline DLP
HTTP 200
{
  "verdict": true,
  "transformedData": { "request": { … } }
}

# denied. still HTTP 200 — a 5xx would trip
# Portkey's fail-OPEN default and let the
# model call through.
HTTP 200
{ "verdict": false }

# a pause is also verdict:false — a synchronous
# webhook cannot hold a request open while a
# human decides. the approval is recorded and
# the call is refused now.

# operator action required on the Portkey side:
#   guardrail failure action = deny

# tenancy travels on the webhook call, so the
# verdict is attributable to a principal:
#   x-governor-org-id
#   x-governor-principal-id
#   x-governor-agent-id

SEAM CAPABILITY

What each seam can execute.

Allow, deny and pause are universal. The richer outcomes — redact, mask, constrain — are not, and a seam that cannot execute an outcome is not permitted to advertise it.

Seam	Request side	Response side	Stated limit
`gateway_execute`	Redact, mask, constrain	Redact and mask, including plain-text and SSE bodies shaped in flight	Constraining is request-side only. A response that cannot be shaped safely fails closed to deny rather than being forwarded un-inspected.
`mcp_invocation`	Redact, mask, constrain — argument-aware	Retrieval output inspected as untrusted retrieved content	Ordinary model-answer responses are not classified on this seam.
`provider_bedrock`	Redact, mask, constrain — verified against the exact payload sent onward	Redact and mask on the response text, with a re-scan that proves the content is gone	Streaming, SSE and binary Bedrock responses are not shaped. Content a detector cannot localize fails closed rather than being partially redacted.
`provider_azure`	Constrain, re-verified against the exact request	Not offered	Response shaping is not available on this seam. A constraint that cannot be honoured fails closed to deny.
`provider_gcp`	Constrain, re-verified against the exact request	Not offered	Response shaping is not available on this seam.
`sdk_wrapper`	Consult only — allow, deny, pause	Not offered	The SDK path receives a decision, not a shaped payload; choosing a shaping outcome here downgrades to deny.

Continue

DevelopersThe adapter table, with binaries and ports Runtime EnforcementDecide at the action boundary Discovery & Shadow AIThe full per-vendor parsing contracts

Find and qualify

Decide and enforce

Prove and observe

Risk and security

By persona

By risk

By platform

By cloud and runtime

Does it meet the stack you already run?

Where the decision is applied.

01Gateway and proxy adapters

02LLM gateways — governing the model call itself

Named platform coverage.

Where unregistered AI activity shows up.

01Agent frameworks

02Identity and consent

03SIEM, log and telemetry

Policy as a reviewed artifact.

How each LLM-gateway adapter attaches and answers.

What each seam can execute.

Continue