GovernanceHost

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Bounded context	BC-18 Policy
Platform / plane	Governance / Trust & Operations
Deployment granularity	standalone host
Status	target · ConnectSoft.Factory.Governance
Built from	connectsoft-microservice · libraries: connectsoft-extensions-audit-net, connectsoft-extensions-compliance, connectsoft-extensions-resource-server, connectsoft-extensions-saas-abstractions, connectsoft-extensions-saas-asp-net-core, connectsoft-extensions-messaging-model, connectsoft-extensions-messaging-model-orleans, connectsoft-extensions-persistence-model-nhibernate, connectsoft-extensions-observability
Decisions	ADR-0012, ADR-0015, ADR-0016, ADR-0017, ADR-0019
Traceability	FR-06 FUX-05 NFR-01 NFR-04 NFR-10 XL-05 XL-13

Purpose and responsibilities

GovernanceHost is the Factory's decision point. Run Control asks it whether a run may be accepted and who may approve; the runtime, the model gateway and the tool executor ask it before every gated call; Knowledge asks it how to classify and redact; Integration asks it who may be granted a connection; everyone asks its secret broker for credentials. It composes four modules (PolicyEngineService, ApprovalPolicyService, AuditService, SecretBrokerService) over the governance store, the immutable audit store and Key Vault, and it runs with three replicas because when it is unavailable, every caller fails closed by design.

Context and boundaries

flowchart LR
    S["GovernanceHost"]
    ControlPlaneApi["ControlPlaneApi"] -->|grpc| S
    AgentRuntimeWorker["AgentRuntimeWorker"] -->|grpc| S
    ModelGatewayHost["ModelGatewayHost"] -->|grpc| S
    ToolExecutorHost["ToolExecutorHost"] -->|grpc| S
    KnowledgeHost["KnowledgeHost"] -->|grpc| S
    IntegrationHost["IntegrationHost"] -->|grpc| S
    StudioBff["StudioBff"] -->|sync-http| S
    S -->|sync-http| ext_key_vault["ext-key-vault"]
    S -->|sync-http| ext_identity_platform["ext-identity-platform"]
    S -->|grpc| ControlPlaneApi["ControlPlaneApi"]
    S -->|sync-http| ext_config_platform["ext-config-platform"]

Hold "Alt" / "Option" to enable pan & zoom

flowchart LR
    subgraph Host["GovernanceHost (3 to 10 replicas)"]
        direction TB
        Pol["PolicyEngineService<br/>bundles, decisions"]
        Apr["ApprovalPolicyService<br/>rules, routing"]
        Aud["AuditService<br/>evidence chain, classification, findings"]
        Sec["SecretBrokerService<br/>references, issuances"]
    end
    CP["ControlPlaneApi"] -- "Decide, Route, ValidateDecision" --> Host
    RT["AgentRuntimeWorker"] -- "Decide" --> Host
    MG["ModelGatewayHost"] -- "Decide, Issue" --> Host
    TE["ToolExecutorHost"] -- "Decide, Issue" --> Host
    KH["KnowledgeHost"] -- "Classify, Redact, Issue" --> Host
    IH["IntegrationHost"] -- "grant policy, Issue" --> Host
    Host --> SQL["('governance-sql')"]
    Host --> IMM["('audit-immutable')"]
    Host --> KV["Key Vault"]
    Host --> IDP["Identity Platform"]

Hold "Alt" / "Option" to enable pan & zoom

Domain model

None modelled

No aggregates are modelled for this item yet.

No entities modelled.

Entities and value objects

None modelled

No entities or value objects are modelled for this item yet.

Data model and storage

Store	Role	Engine / profile	Tables
Governance store	primary	azure-sql / nhibernate-sqlserver	—
Immutable audit store	blob	blob / azure-blob-immutable	—
Secret store	primary	key-vault / azure-key-vault	—
Cache and coordination	cache	redis / azure-cache	—

None modelled

No tables are modelled for this item yet.

APIs

Method	Path	Operation	Scope	Side effects	Idempotency	Gateway	Summary
GET	/governance/health	GovernanceHealth	factory.health.read	read	natural	GW-01	Liveness, readiness and dependency health (governance store, immutable audit store, Key Vault, identity platform).
GET	/governance/meta/revisions	GovernanceRevisions	factory.meta.read	read	natural	GW-03	Active policy and approval-rule revisions per scope and the audit hash-chain head; used by operators and the Studio about page.

None modelled

No gRPC methods are modelled for this item yet.

Messages

None modelled

No events are modelled for this item yet.

None modelled

No commands are modelled for this item yet.

None modelled

No consumed events are modelled for this item yet.

Workers and jobs

None modelled

No workers are modelled for this item yet.

Actors and grains

None modelled

No grains are modelled for this item yet.

Sagas and long-running flows

None modelled

No sagas are modelled for this item yet.

Options and configuration

Section	Key	Type	Default	Reloadable	Secret	Summary
Governance:Host	EnabledModules	string[]	[policy, approval-policy, audit, secret-broker]	no	no	Modules composed into this host.
Governance:Host	FailClosed	bool	true	no	no	Every decision call fails closed when a dependency is unavailable.
OrleansMessaging	ServiceName	string	governance	no	no	Messaging profile service name.

Metrics and observability

Metric	Instrument	Unit	Dimensions	Summary
connectsoft.factory.governance.host.requests	counter	{request}	module, method, status	Requests per module.
connectsoft.factory.governance.host.decision_latency	histogram	s	module	Latency of decision calls; on the hot path of every run.

Security

Authentication	client-credentials
Scopes	factory.health.read (Health probes.); factory.meta.read (Revision metadata.)
Roles	Operator, PlatformAdmin, Observer
Tenant isolation	row-filter
Data classification	restricted
Max side-effect class	production
Secrets	governance-sql (key-vault, rotate 90 d); audit-chain-key (key-vault, rotate 365 d); messaging-transport (key-vault, rotate 90 d)

Dependencies

Outbound

Target	Kind	Purpose	Failure mode	Required
ext-key-vault	sync-http	Secret values for the broker; signing keys for the audit chain.	fail-fast	yes
ext-identity-platform	sync-http	Roles	fail-fast	yes
ControlPlaneApi	grpc	Scope resolution and asset releases (policy bundles).	fail-fast	yes
ext-config-platform	sync-http	Feature flags for policy rollout.	degrade	no

Inbound

Target	Kind	Purpose	Failure mode	Required
ControlPlaneApi	grpc	Policy decisions	—	yes
AgentRuntimeWorker	grpc	Decisions before gated calls.	—	yes
ModelGatewayHost	grpc	Decisions per invocation; provider credentials.	—	yes
ToolExecutorHost	grpc	Decisions per invocation; sandbox credentials.	—	yes
KnowledgeHost	grpc	Classification	—	yes
IntegrationHost	grpc	Grant policy; connection credentials.	—	yes
StudioBff	sync-http	Policy	—	yes

Failure and recovery

Scenario	Detection	Recovery	Data impact	RTO (min)
Host unavailable	decision calls fail	every caller fails closed (no run accepts	none	15
Immutable audit store unreachable	evidence write failures	evidence buffered in the governance store outbox and written in order when the store returns; the hash chain is not broken	delayed evidence	60

NFR targets

Target	Class value (pilot-interactive)	Override
latency_p95_ms	2000	—
availability_pct	99.5	—
throughput_rps	50	—
rpo_minutes	15	—
rto_minutes	240	—
cost_class	low	—

Deployment

Granularity	standalone host
Topologies	saas-default, hybrid, on-prem, hybrid-compute
Runtime	aks; replicas 3–10
Ports	https 8000, grpc 8002, silo 12000, gateway 31000

Current implementation

ConnectSoft.Extensions.AuditNet (Audit.NET integration), ConnectSoft.Extensions.Compliance (classification and redaction), ConnectSoft.Extensions.ResourceServer (capability-based authorization) and the MCP governance toolkit options exist; no policy engine, approval rules, evidence chain or secret broker exists.

Later capabilities

Policy simulation at depth; risk scoring and security findings services (later rows); regional host pairs.

Decisions and traceability

Family	Ids
FR	FR-06
FUX	FUX-05
NFR	NFR-01, NFR-04, NFR-10
XL	XL-05, XL-13

Related

• Governance overview · PolicyEngineService · ApprovalPolicyService · AuditService · SecretBrokerService

• Governance microservices · bounded contexts · APIs · events · data model

• Services catalog · Ownership map