Skip to content

Governance — overview

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Rewritten 2026-10-09 (design plan P7)

This page replaces the June-2026 overview with its ten governance domains and separate policy, approval, audit, classification, risk and findings services. The 2026 design keeps the domains as rule families and evidence kinds inside four modules of one host; risk scoring, security findings and compliance reports stay later rows. The old page is archived under catalogs 2026-06.

Governance is where the Factory says no, says "not without a human", and proves afterwards what happened. Every other platform asks it before acting and tells it what it did; it fails closed for all of them.
Platform PF-12 Governance (Trust & Operations)
Bounded contexts BC-18, BC-19, BC-20, BC-40
Services 15 (1 hosts, 11 modules, 0 external, 3 later) — 5 modelled
Gateways —
Status target

Purpose

  • Policy is central and typed. Who, which agent, which models, which data, which tools, which environment, which budget (original handoff §43) as Published bundles per scope; a project may only tighten its tenant, a tenant only the platform (D18).
  • Decisions are recorded, approvals are exact. Effects allow, deny, require-approval, prohibited; approvals of class shared-write and above bind to the exact proposal and are decided by eligible people who are never the requester or the author (ADR-0015, D21).
  • Evidence is immutable. A hash-chained, head-signed, mirrored audit trail with 7-year retention; classification drives retention, redaction and routing (D31).
  • Secrets are brokered. Short-lived, scoped, delivered once, revoked with the lease (§46).
  • AI threats are first-class. Prompt and tool injection, indirect injection through content, exfiltration, malicious MCP servers and skills, model supply chain, unsafe commands, secret leakage, cross-tenant retrieval and poisoned knowledge (§44) each map to a control in this platform or one it governs.

Bounded contexts and services

Context Owns Services (granularity)
BC-18 Policy Bundles, rules, decisions PolicyEngineService (module); definition, evaluation, memory policy and tenant isolation rows merged
BC-20 Approval Policy Approval rules, routing and validation ApprovalPolicyService (module)
BC-19 Audit, Risk & Compliance Evidence chain, classification and redaction, findings, exports AuditService (module); classification and redaction rows merged; compliance report, risk scoring and security finding rows later
BC-40 Secret Broker Secret references, issuances, rotation receipts SecretBrokerService (module, added)
Host Composition, fail-closed posture GovernanceHost (standalone)
Service Context Granularity Status
ApprovalPolicyService BC-20 module of host target
AuditService BC-19 module of host target
ComplianceReportService BC-19 later stage unmodelled
DataClassificationService BC-19 module of host unmodelled
GovernanceHost BC-18 standalone host target
MemoryClassificationService BC-19 module of host unmodelled
MemoryPolicyService BC-18 module of host unmodelled
MemoryRedactionService BC-19 module of host unmodelled
PolicyDefinitionService BC-18 module of host unmodelled
PolicyEngineService BC-18 module of host target
PolicyEvaluationService BC-18 module of host unmodelled
RiskScoringService BC-19 later stage unmodelled
SecretBrokerService BC-40 module of host target
SecurityFindingService BC-19 later stage unmodelled
TenantIsolationPolicyService BC-18 module of host unmodelled

Role in the Factory

flowchart LR
    CP["Control Plane"] -- "acceptance decisions, approval routing" --> G["Governance<br/>GovernanceHost"]
    Mesh["Agent Mesh"] -- "decisions before gated calls" --> G
    MC["Model & Compute"] -- "decisions, provider credentials" --> G
    Tools["Tools & MCP"] -- "decisions, sandbox credentials" --> G
    KM["Knowledge & Memory"] -- "classification, redaction, promotion policy" --> G
    Int["Integration"] -- "grant policy, connection credentials" --> G
    All["Every platform"] -- "events as evidence" --> G
    G -- "findings, exports" --> Obs["Observability, tenants, auditors"]
Hold "Alt" / "Option" to enable pan & zoom

The trust boundaries (original handoff §45)

Boundary Trust Who sets it
System policy highest Platform admin through Published bundles
Agent instructions release-pinned Asset maintainer, reviewed
Skill instructions release-pinned Asset maintainer, reviewed
User instructions scoped by role the requester within policy
Trusted enterprise knowledge source fact with provenance ingestion with ACL
Tool results data, never instructions the executor's sanitization
Untrusted external content lowest; labelled retrieval and browser tools

Component view

flowchart LR
    subgraph P["Governance"]
        GovernanceHost["GovernanceHost"]
    end
    P --> ProjectService["ProjectService"]
    P --> ext_identity_platform["ext-identity-platform"]
    P --> ArtifactService["ArtifactService"]
    P --> ext_key_vault["ext-key-vault"]
    P --> ControlPlaneApi["ControlPlaneApi"]
    P --> ext_config_platform["ext-config-platform"]
    P --> AgentRegistryService["AgentRegistryService"]
    P --> EnvironmentService["EnvironmentService"]
Hold "Alt" / "Option" to enable pan & zoom

Built from the ConnectSoft estate

Component Use here Status
ConnectSoft.Extensions.AuditNet (Audit.NET) evidence capture in hosts extend
ConnectSoft.Extensions.Compliance classification and redaction rules extend
ConnectSoft.Extensions.ResourceServer capability-based authorization at every host exists
MCP governance toolkit integration policy paths for MCP tools extend
Key Vault with workload identity secret custody exists
Policy engine, approval policy, evidence chain, secret broker the platform itself develop

Modernization (2 to 3 year horizon)

  • Guardrails and prompt-injection defence as trust tiers plus output validation and tool gating, not as prompt tricks.
  • Workload identity for agents (SPIFFE-style) with delegated user scopes per run (extends ADR-0101 and ADR-0015).
  • Evidence-driven compliance: exports with chain proofs instead of screenshots.
  • Policy as published asset with evaluation and simulation before activation (D32).

Current implementation

Audit.NET and Compliance libraries, capability-based authorization and MCP governance options exist; no policy engine, approval rules, evidence chain, classification registry or secret broker exists. See the plane index and security by plane.

Final-state summary

One fail-closed host, four modules; every action has a decision, every gated action an exact approval, every event an evidence entry, every credential an issuance; a tenant can prove what its agents did and why.