01 / Decide in your environment
Policy beside the workload.
Run the gateway beside the workload. Your application asks it for a verdict before each governed call.
Distribute policy. Evaluate beside the workload.
Platform / Security architecture
The agent proposes. Your policy authorizes.
Independent governance beside your agents, not above your security team. Run the enforcement gateway in your environment and keep your identity provider.
Decided per action, not per session
Your identity provider. Your policy authority. Your deployment choices.
Govern centrally. Decide in your environment.SDK + isolated gateway
GovernorAI control planeauthor · distribute
policy↓
Your environment
Your agentproposes an action
→ Policy checkby your gateway before your app dispatches
→ Your systemcalled by your app after allow
Tool credentialskept by your application when it dispatches
Security & AI SecurityWhat your team can do to agents: per-call authorization, stop controls, containment. Operator's view
Trust & securityHow GovernorAI is operated: data handling, deployment shapes, access control, incident response. What a review is handed
you are here
Security architectureHow GovernorAI is built, layer by layer.
The architecture behind the advantage
Four ways you keep control.
Independent authorization, evaluation in your environment, your existing stack, and a hash-chained audit log. Together, they keep governance under your control.
02 / Retain authority
Nothing a model returns turns a deny into an allow.
An optional model-backed detector can add a deny.
03 / Keep your stack
Your security systems stay yours.
Keep your identity provider. In the decide-only mode of the Python and TypeScript SDKs your application keeps its tool credentials, its tool code and its control flow.
An integration, not a replacement project.
04 / Keep the record
An audit log you can recheck.
The control-plane audit log is hash-chained with SHA-256. Verification recomputes each entry’s hash and its link to the entry before, and reports the first entry where they disagree.
Chain the log. Recheck the chain.
In the product
See the security controls in the console.
A recorded walk through the controls behind this page: a denied action with the policy that blocked it, a destructive tool call denied inline at the gateway before it ran, and a kill switch's scope in its audit entry.
The controls, step by step
Real product screens from a demo tenant with seeded activity. No kill switch, role, provider or user was changed while recording.
Recorded against a demo tenant with seeded activity. Real product screens, not a mock-up.
Inspect a decision event
One governed call. One decision event.
A denied call and the decision event it produces. Illustrative data; no agent or system is contacted.
Each governed call gets its own verdict.
GovernorAI / decision eventIllustrative values
billing.issue_refundagent refund-assistant
DENY
Denied by policy.
agent_idrefund-assistant
decisiondeny
policy_idrefund-policy
rule_idrefund-over-limit
Inspect the sample event json
{
"illustrative": true,
"agent_id": "refund-assistant",
"tool": "billing.issue_refund",
"decision": "deny",
"policy_id": "refund-policy",
"rule_id": "refund-over-limit"
} Defence in depth
A control plane in the execution path is a target.
GovernorAI sits where agents act, next to your credentials and your systems of record. Ten layers of its own controls, each stated as the mechanism that implements it. Open a row for the detail a reviewer will ask about.
Who is asking, and what they may do
01–03#LayerMechanism
01IdentityWho is askingOAuth2/OIDC and SAML single sign-on against your identity provider. TOTP multi-factor. Account lockout after repeated failures.+
- OAuth2/OIDC and SAML single sign-on against your identity provider.
- TOTP (RFC 6238) multi-factor.
- Account lockout after repeated failures.
- A time-limited, single-use password-reset token.
02SessionWhat a token is worthSigned JWT sessions, with CSRF protection.+
- The refresh token is held in an HttpOnly, SameSite=Strict cookie scoped to the auth endpoints.
- An agent API key cannot be exchanged for an interactive user session.
03AuthorizationWhat that identity may doRoute permissions checked through RBAC against a registry of defined permissions.
What the platform calls, holds and absorbs
04–06#LayerMechanism
04Transport & outboundWhich outbound calls are guardedWebhook subscriptions, HTTP-based SIEM connectors and external OPA calls use an SSRF-safe client that checks the resolved IP at dial time.+
- The client's authoritative check is a dial-time hook on the resolved IP, after DNS, not on the URL string.
- The AWS instance-metadata address stays blocked even when private addresses are permitted.
- In production mode (
GOVERNOR_ENV=production), the database connection verifies the server certificate.
05SecretsHow credentials are heldCloud-provider integration credentials encrypted AES-256-GCM before they are stored.+
- In production mode (
GOVERNOR_ENV=production) the control plane will not start without a persistent encryption key. It does not fall back to an ephemeral one.
06AbuseCost of being noisyRate limits shared through Redis where it is configured.+
- If Redis errors, each replica falls back to its own in-memory limit.
What is decided and written down
07–08#LayerMechanism
07EnforcementWhen the verdict is missingThe Envoy ext_proc, MCP proxy and forward-auth adapters treat a missing verdict as a deny.+
- A transport error, timeout, non-2xx response or unreadable verdict from the gateway counts as missing.
08RecordRechecking the audit chainThe control-plane audit log is hash-chained with SHA-256.+
- Each entry carries
prev_hashandentry_hash. Verification recomputes each hash and its link to the entry before, and reports the first entry where they disagree.
Stopping it, and shipping it
09–10#LayerMechanism
09ContainmentStopping itAn agent-scoped stop denies governed calls that carry that agent’s id.
10BuildScanned in CIDependency vulnerability scan, static analysis and secret scanning on pull requests and on main.+
govulncheckandgosecon pull requests, on push to main and weekly.gitleaksacross the commit range.- The production go/no-go check, run by hand before a release, rejects an untracked or uncommitted Security Hub exception.
Bring your security team. Bring one real workflow.
Map the deployment and credential boundaries. Walk the permit and deny paths. Review the policies and the evidence your team will expect to see.
- Trust & securityData handling, deployment shapes, access control, incident response.Read
- BenchmarkIn-process policy-engine measurement, with the method stated.Read
- Kubernetes & sidecarWhere the in-cluster and on-host components run.Read
- Evidence & complianceHash-chained audit history, policy context and control mapping.Read
Governance you can put in the execution path.
Independent governance for the agents your enterprise already runs: per-action decisions and policy-controlled permission.
Continue
Platform overviewFive stages, seven product surfaces, one policy object Runtime EnforcementDecide at the action boundary ContainmentAgent-scoped kill switches Evidence & ComplianceHash-chained audit record, mapped to controls Decision ObservabilitySee the decision behind the action IntegrationsPlatforms and enforcement points