The action proceeds unchanged
Policy resolved, the call is dispatched as written, and the decision is still recorded. An allow is evidence, not an absence of governance.
shapes no payloadPLATFORM / RUNTIME ENFORCEMENT
Governance where intent becomes consequence.
A wrong answer is a support ticket. A wrong action is an entry in a system of record. GovernorAI evaluates the call an existing agent is about to make and the action it then takes — at the seams the integration supports — and executes only the outcomes that seam can genuinely carry out. Everything else fails closed to deny.
Deterministic decision path Fail-closed by contract Seven registered seams No SDK required in the agent
Three outcomes end or suspend the call, and one lets it through. Allow is still a governed decision — it is recorded exactly like a denial.
6 outcomes7 seamsfail closedno model in the decision loop
THE CONSEQUENCE PROBLEM
Agents are no longer just answering questions.
A wrong answer is a support ticket. A wrong action is an entry in a system of record — made under an identity nobody reviewed, at a speed no approval queue was designed to absorb.
A support agent calls
support.issue_refund — amount $12,400 every check below passed The credential ✓Checks out
Valid, unrevoked, unexpired, and bound to an organisation that overrides whatever the caller puts in a header.
Your IAM ✓Already said yes
Settled upstream. Nothing here overturns it — this is what runs after access has been granted.
The detectors ✓Found nothing
Deterministic families — secrets, data loss, prompt injection, risky tool intent, unsafe destination — ran before policy, and the empty result is recorded with the rule-pack version that produced it.
The policy ✓Allowed it
The tool is permitted for this agent. No deny rule matched.
The action ✕Stopped anyway
$12,400 crosses a threshold your organisation set. The workflow’s first step names a role, not a person — so the hold is not satisfied until someone who actually holds that role votes.
Nothing was dispatched and nothing executed. Every check that could have stopped it said yes, and the refund still did not happen, because the one question left is not about identity or threat — it is whether an action of this consequence should proceed without a person. That shape is not a slide: our test suite runs this against a deliberately allow-everything policy, and a configured approval trigger still holds the call — a permissive policy cannot suppress it.
The gap IAM asks whether this identity may act. Threat detection asks whether this is malicious. Neither is built to ask whether this is consequential enough to need a human.
See it on your own agents →Watch the 90-second walkthrough →
THE OUTCOMES
Six things an enforcement point can do to an action.
Three of them stop or hold the action. Three of them change its payload. The difference matters, because a seam that can decide is not automatically a seam that can rewrite.
The action is blocked, not executed
The target never sees the call. On the SDK path the wrapped function is never invoked and the caller gets the policy reason rather than a result.
shapes no payloadHeld for a human decision
Carried internally as require_approval in audit and evidence, and delivered as pause at the SDK and HTTP boundary. On the Bedrock inbound path the proxy returns a 202 while the request waits.
The value is replaced with a non-recoverable token
Driven by the secret detector. Applied to request arguments and, on the seams that support it, to response bodies — JSON, plain text, and streaming bodies redacted in flight.
shapes the payloadThe value is replaced with a deterministic mask
Driven by the sensitive-data classifier and by structurally validated identifiers — payment-card numbers checked with Luhn, US social security numbers range-validated.
shapes the payloadThe offending argument key is dropped
Request-side only. Argument narrowing reaches into JSON-encoded sub-fields of a tool call, and the narrowed arguments are re-verified against the exact payload actually sent upstream.
shapes the payload · request sideNo model in the decision loop
The verdict comes from policy evaluation and deterministic detectors — regex, Luhn and range checks, keyword and path rules. An optional semantic detector exists, is off unless an operator enables it, can only add a deny to the strictest-outcome selection, and resolves a model error or timeout to deny.
policy + detectors, not inferenceEvery decision is written down
Each verdict carries an explain code and a reason, and lands in the hash-chained audit ledger alongside the action context that produced it.
see Evidence & Compliance| Detector | What it catches | Resolves to |
|---|---|---|
| secret | Credential material — API keys, bearer tokens, JWTs and provider-specific key formats. | REDACT |
| sensitive_data | Regulated and confidential content, using the existing data-classification rule set rather than a forked one. | MASK at high and critical, approval at medium, allow below |
| regulated_identifier | Structurally validated identifiers the other two miss — payment-card numbers confirmed with a Luhn check, US social security numbers range-validated. | ALLOW · signal only, no rewrite |
| prompt_injection | Instruction-override attempts against the deterministic keyword floor. | DENY · signal only |
| encoded_payload | Base64 and hex runs that decode to printable text — the technique of smuggling instructions past a keyword filter by encoding them. Deliberately does not auto-block: a long printable base64 run is low-confidence evidence, because base64 is a common legitimate transport. It is surfaced as a detected type for a policy to gate on. | DENY · signal only |
| risky_tool_intent | Tool calls whose shape carries consequence a human should see before it lands. | APPROVAL · signal only |
| unsafe_destination | A destination argument pointing somewhere policy does not permit. | CONSTRAIN — the field is dropped |
| semantic_injection | Paraphrased or obfuscated instruction-override the keyword floor misses. Off unless an operator enables it, and it rides an existing model client rather than new infrastructure. | DENY · signal only · can only add a deny, never soften one · model error or timeout resolves to deny |
Stated precisely Only the outcomes listed for a seam are executed by that seam. Requesting a richer outcome on an unsupported seam fails closed to deny.
The seam capability registry is the load-bearing contract, not a marketing table: the inspector consults it at runtime and downgrades an unsupported outcome to deny, flagged as downgraded with an explain code suffixed _DOWNGRADED, so the product surfaces the downgrade rather than claiming the outcome that was asked for. A shaping outcome that rewrites zero fields is never reported as shaped either — it also fails closed. Redaction, masking and constraining apply where the seam supports them; allow, deny and approval do not touch the payload at all.
THE SEAM MATRIX
Seven seams. What each one actually executes.
A seam is a code path where GovernorAI mediates an interaction. Each registered seam declares which interaction kinds it can inspect and which outcomes it can truthfully carry out. The product ships the matrix as a read-only API and shows it to operators — including the capabilities that are missing. Response inspection is real on two of these seams: gateway_execute shapes JSON, plain-text and streaming SSE bodies, redacting and masking in flight, and provider_bedrock inspects and shapes its own response text with the same re-scan proof before anything is returned.
FROM THE PRODUCT
The seam capability matrix, as it ships.All seven seams in one view, with request and response inspection and the six outcomes marked per row. Green ticks are capabilities the seam executes; grey crosses are capabilities it does not have, printed rather than omitted. Every row carries an honesty note explaining its boundary, and the banner above the table states the rule the runtime enforces.
outcome — supportedoutcome — not supported Struck through and dimmed means the enforcement point cannot carry out that outcome. Every unsupported entry also states so in text.
| Seam | What it mediates | Outcomes executed | Boundary |
|---|---|---|---|
| gateway_execute | The central inline decision path for tool and MCP invocations. Inspects prompts, tool arguments, response bodies and payloads, and treats a governed retrieval body as untrusted retrieved content. | allow — supporteddeny — supportedapproval — supportedredact — supportedmask — supportedconstrain — supported | Shaping covers request arguments and response bodies, including JSON, plain text and streaming. When a response cannot be shaped safely — binary or non-text content, JSON that cannot be rewritten without corrupting it, or a sensitive value longer than the streaming inspection window — the seam denies rather than forwarding un-inspected data. Constrain is request-side only. |
| mcp_invocation | Tool and MCP invocations routed through the gateway with an MCP id populated. Argument-aware inspection runs even where prompt or response classification would be a no-op. | allow — supporteddeny — supportedapproval — supportedredact — supportedmask — supportedconstrain — supported | Retrieval bodies an operator declared as a fetch are inspected as untrusted retrieved content for indirect injection. Ordinary model-answer responses are not inspected on this seam. |
| provider_bedrock | The AWS Bedrock inbound seam. Invocations arrive from inside AWS and the Lambda proxy executes the tool after the gateway returns a decision — the gateway does not make the outbound model call. | allow — supporteddeny — supportedapproval — supportedredact — supportedmask — supportedconstrain — supported | Shaped arguments are verified against the exact payload sent to the proxy; a shaping that cannot be applied cleanly denies rather than sending a half-shaped request. The gateway also shapes its own Bedrock response text for content a detector can localize. Streaming, SSE and binary Bedrock responses are not shaped. |
| provider_azure | The Azure AI Foundry Agents provider adapter, as a gateway-side inline proxy over prompts and tool calls. | allow — supporteddeny — supportedconstrain — supportedapproval — not supported on this enforcement pointredact — not supported on this enforcement pointmask — not supported on this enforcement point | Request arguments can be constrained, and the constrained arguments are re-verified against the exact payload posted to Azure AI Foundry — a constraint that cannot be honored denies rather than forwarding an unconstrained request. Response shaping is not offered on this seam. |
| provider_gcp | The GCP Vertex AI and Gemini provider adapter, as a gateway-side inline proxy over prompts and tool calls. | allow — supporteddeny — supportedconstrain — supportedapproval — not supported on this enforcement pointredact — not supported on this enforcement pointmask — not supported on this enforcement point | Same boundary as Azure: argument narrowing is re-verified against the exact Vertex AI request and denies if it cannot be honored. Response shaping is not offered on this seam. |
| saas_native | In-SaaS native surfaces. ServiceNow runs a scoped app whose before business rules can abort the write; Salesforce and similar are event-ingest only, with no request-body interception. | allow — supporteddeny — supportedapproval — not supported on this enforcement pointredact — not supported on this enforcement pointmask — not supported on this enforcement pointconstrain — not supported on this enforcement point | No body interception, so no inline rewriting is claimed — the shaping outcomes stay off. But a deny is not always compensating: on ServiceNow the scoped app installs before insert and update rules on change_request, incident, sc_request and sc_task that call setAbortAction(true), so the record never commits. On Salesforce and the event-ingest surfaces a deny is a downstream control action — a kill switch or a session revoke. |
| sdk_wrapper | The out-of-process SDK consult path, where a Python, Go or JavaScript SDK asks the gateway for a verdict on a call it is about to make. | allow — supporteddeny — supportedapproval — supportedredact — not supported on this enforcement pointmask — not supported on this enforcement pointconstrain — not supported on this enforcement point | The consult path returns a decision; it does not receive a shaped payload back. Shaping outcomes are therefore not advertised to SDK callers, and choosing one downgrades to deny. |
GATEWAY INSERTION
Govern with no SDK in the agent.
Drop the decision into the MCP or API gateway you already run. Each adapter is a thin protocol translator: it parses a tool call off the wire, builds the canonical execute request, and asks the gateway for the verdict. There is one decision brain — policy, data controls, injection deny, approvals, kill switch, hash-chained evidence — and these adapters never re-implement it.
The service mesh you already have
A gRPC external processor for Envoy Gateway, Istio, Gloo, Envoy AI Gateway and agentgateway. Allow continues, redact becomes a body mutation, approval returns 202, deny returns 403.
failure_mode_allow must be falseTransparent proxy in front of an MCP server
Point the MCP client's server URL at the proxy. tools/call is governed; initialize, tools/list, ping and notifications pass through untouched. Allow forwards, redact rewrites the call arguments, approval and deny return a JSON-RPC error.
An auth check your proxy already speaks
NGINX auth_request, Traefik ForwardAuth, an AWS Lambda authorizer, Apigee, Azure API Management. Allow returns 200; approval and deny return 403. A JSON verdict mode returns the decision and shaped arguments for guardrail webhooks.
Coexistence with an AI gateway
A Portkey bring-your-own-guardrail webhook and a LiteLLM custom guardrail govern the model call itself. Our endpoint answers with an explicit negative verdict rather than a 5xx, because those hosts treat a server error as pass.
govern the call, not the keys# The identity travels in governor.* request headers:
# x-governor-agent-id · x-governor-org-id · x-governor-mcp-id · x-governor-tool
http_filters:
- name: envoy.filters.http.ext_proc
typed_config:
grpc_service: { envoy_grpc: { cluster_name: governor_extproc } }
processing_mode:
request_header_mode: SEND
request_body_mode: BUFFERED
failure_mode_allow: false # REQUIRED — fail closed if the processor is unreachableTHE ARCHITECTURAL SPINE
Fail closed, or it is not enforcement.
An enforcement point that lets calls through when it is confused is a logging product with extra latency. Every path here resolves an unresolvable situation the same way: deny, with a reason, recorded.
| Condition | Resolution | Why |
|---|---|---|
| Gateway unreachable | DENY | A transport error is not an answer. The adapter synthesizes the deny and marks it as fail-closed so it is distinguishable in logs from a genuine policy deny. |
| Decision timeout | DENY | The decision client carries an explicit timeout, five seconds by default and configurable per deployment. Expiry resolves to deny, never to allow. |
| Non-2xx response | DENY | The gateway returns 200 for every real verdict, including deny and approval. So any 4xx or 5xx is an error condition, and the body is not trusted to argue otherwise. |
| Unparseable response | DENY | If the verdict cannot be read it has not been received. |
| Unsupported outcome for the seam | DENY | The seam registry says this seam cannot execute the outcome policy chose. Downgrading to something weaker would be a silent lie, so the decision resolves to deny and is flagged as downgraded. |
| Shaping rewrote zero fields | DENY | A redaction that changed nothing is not a redaction. The applier returns the count of fields actually mutated so the gateway can refuse to label it as shaped. |
| Redaction fails re-scan | DENY | After a plain-text body is shaped it is re-scanned with the same detectors. If anything still fires, the body still leaks and is not forwarded. |
| Un-localizable sensitive content | DENY | Only detectors that can prove where a match sits contribute spans. A classifier that returns a verdict with no offsets cannot drive a rewrite, so a shaping outcome resting solely on it denies instead. |
| Streaming window exceeded | DENY | The in-flight shaper keeps a bounded overlap so a token split across chunks is still seen whole. When a flush could emit the prefix of an unbounded secret, or an event exceeds the safe buffer cap, the stream terminates rather than emitting raw bytes. The window is honest: it is not unbounded in-flight redaction. |
| Shaped payload cannot be verified | DENY | On the provider seams the shaped or narrowed arguments are compared against the exact payload about to leave. A mismatch denies rather than forwarding a half-shaped request. |
| Inspection bounds exceeded | DENY | The inspector walks arguments and payloads against a depth and field budget. A structure that exceeds it has not been inspected, and uninspected is not allowed. |
Deny by default, least privilege at the seam
The posture is zero-trust in the ordinary sense: nothing is permitted because it arrived from a trusted network, and an action no policy covers is denied rather than waved through. On the shared, internet-facing deployment a valid credential is required on every governed call, and the tenant is taken from that credential — a header can only ever confirm it, never choose it. A single-tenant deployment you run on an isolated network may accept a keyless caller, but it binds that caller to the one organisation it was configured for, and a credential from any other organisation is refused outright.
The product reports its own posture honestly
A read-only execution-posture surface derives, from real decision records, what was authenticated, which tenant the action was bound to, and what policy decided. It reports the credential mode as scoped_api_key rather than dressing it up, reports signed evidence as configured-dark unless the deployment flag actually says otherwise, and reports just-in-time authorization and brokered credentials as roadmap — never live.
AROUND THE SEAM
Controls that do not wait for the next call.
A per-call verdict is the core, but not the whole surface. These are the controls that operate on an agent, a tool, a session or a whole organization at once.
Stop scope, not just requests
Activate against an agent, a tool, a session, a namespace, a policy or an entire organization. Activation runs through one service so it can never be invisible: the registry write, the cross-pod propagation, the domain event, the audit-timeline row and the webhook dispatch all happen together.
one activation pathOne classifier, not a parallel rule engine
The inline sensitive-data detector reuses the existing classification rule set rather than forking one, so what the data-controls surface says is sensitive is exactly what the seam acts on.
shared rule setA budget per key, endpoint and role
Token-bucket limiting with an in-memory implementation for a single node and a Redis-backed one for a fleet, behind one interface so the behavior does not change with the deployment shape.
in-memory or Redis-backedGovern the tunnel, not the payload
A cluster-side agent governs each outbound CONNECT tunnel at the host and port level by asking the same gateway for a verdict, then opens raw TCP forwarding on allow. It does not terminate TLS — the body stays encrypted end to end between the caller and the destination.
one decision per tunnel openWebhook delivery that cannot be redirected inward
Outbound requests to tenant-supplied URLs are checked at dial time against the actual resolved IP, refusing loopback, private, link-local and cloud-metadata ranges. Because the check runs at the moment of dialing, a hostname cannot pass validation and then re-resolve inward, and every redirect hop is re-validated.
DNS rebinding closedAttach the controls the platform already has
Where a provider ships its own guardrail plane, policy is compiled and attached to it, and any divergence from the source policy is named rather than hidden. This complements the inline seam; it does not stand in for it.
see Policy & GovernanceOUTCOME BY SEAM
Which outcomes each seam can carry out, cell by cell.
A note on the word. An enforcement point is the mediated control point between an agent's intent and the target system. It implements the PDP/PEP pattern of NIST SP 800-207: GovernorAI is the policy decision point — it evaluates the policy and returns a verdict — and the mediated integration is the policy enforcement point, executing that decision before the target system is reached. Neither component is both. The registry calls these seams, and that is the term used in the API values and the table below.
The table above states what each seam mediates and where its boundary lies; this one answers the narrower question outcome by outcome. Every seam declares which interactions it can inspect and which outcomes it can truthfully carry out. The runtime consults this registry on every call — ask a seam for an outcome it does not declare and the result is a deny marked as a downgrade, never a silent fallback to something weaker. The product ships this as a read-only API, including the gaps.
| Seam | Inspects | Allow | Deny | Pause | Redact | Mask | Constrain |
|---|---|---|---|---|---|---|---|
| gateway_execute | tool call · MCP call · prompt · response · payload · retrieved content | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| provider_bedrock | tool call · prompt · response | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| mcp_invocation | MCP call · tool call · retrieved content | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| provider_azure | tool call · prompt | ✓ | ✓ | — | — | — | ✓ |
| provider_gcp | tool call · prompt | ✓ | ✓ | — | — | — | ✓ |
| sdk_wrapper | tool call · prompt | ✓ | ✓ | ✓ | — | — | — |
| saas_native | out-of-band events — no body interception | ✓ | ✓ | — | — | — | — |
A dash is a capability the seam does not have — printed, not omitted. Response shaping on gateway_execute covers JSON and plain-text/SSE bodies, including streaming responses, redacted and masked in flight. Where a response cannot be shaped safely — binary content, JSON that cannot be rewritten without corrupting it, or a sensitive value longer than the streaming inspection window — the seam denies rather than forwarding un-inspected data. Shaped arguments are re-verified against the exact payload sent upstream; shaping that cannot be applied cleanly fails closed.
DETECTORS
Seven deterministic detectors, each declaring what it resolves to.
Regular expressions, Luhn and range checks, keyword and path rules. Two of the eight inspect retrieved content — the indirect-injection case where hostile text arrives in a document the agent fetched, after your prompt review has already passed.
Detector
What it catches
Resolves to
secretAPI keys, bearer tokens, JWTs and provider-specific key formats.
redact
sensitive_dataRegulated and confidential content, against your existing classification rule set.
mask at high/critical
regulated_identifierPayment cards confirmed with a Luhn check; US SSNs range-validated.
signal for policy
prompt_injectionInstruction-override attempts against the deterministic keyword floor.
signal for policy
encoded_payloadBase64 and hex runs that decode to printable text.
signal for policy
risky_tool_intentTool calls whose shape carries consequence a human should see first.
approval
semantic_injectionModel-assisted injection detection. Off unless an operator enables it; can only add a deny.
deny only
unsafe_destinationEgress targets outside the permitted set for the call.
signal for policy
IN THE PRODUCT
The surface this page describes.
THE STEP BEFORE THIS ONE
Enforcement is the second decision. Not the first.
Everything on this page decides an action an agent is already taking. That is the right control once an agent is live, and it is only half of the job. The first decision belongs to assurance: whether the agent should have reached production at all — scored on an immutable snapshot against acceptance bars registered before the run, and returned as a gate result a pipeline can act on rather than a report someone reads later.
The two are deliberately separate. An enforcement point that also graded the agent would be marking its own homework, and a verdict is only worth something if what was evaluated and what shipped are provably the same snapshot.
Continue
Platform overviewFive stages, seven product surfaces, one policy object Policy & GovernanceKeep the policy engine you already run Inference & Model GovernanceGovern the model call itself Evidence & ComplianceTamper-evident record Decision ObservabilitySee the decision behind the action IntegrationsWhich gateway or proxy you can insert at