Governance

Enterprise feature. This capability is available on Polyant Enterprise deployments.

Governance applies policy gates to an agent’s input, output, and tool activity. It provides a shared policy catalogue and lets operators assign policies to individual agents.

Policy catalogue

The Governance page lists the policies available to the organization. The catalogue is org-scoped, not deployment-wide and not per-workspace: two organizations on the same engine keep separate catalogues, and every workspace inside one organization draws from its single catalogue. A policy records its name, description, category, severity, gate type, and level. Platform policies marked immutable cannot be edited or deleted.

The catalogue supports these policy categories:

• input-safety
• output-safety
• data-protection
• tool-governance
• rate-limiting

Reading catalogue and analytics data requires agent.governance:read. Creating, changing, or removing a mutable policy requires agent.governance:write.

Assign policies to an agent

Open an agent’s Governance area to view its effective assignments. An assignment selects a catalogue policy and can set:

• Enabled — whether the policy participates in the agent’s pipeline.
• Enforcement — log, warn, or block.
• Configuration override — agent-specific configuration that supplements the catalogue policy.

Assignments and governance analytics use the same agent.governance:read and agent.governance:write permissions. A policy can also be assigned platform-wide, in which case it cannot be removed from an individual agent.

How enforcement works

Each gate runs in one pipeline phase:

• Input gates inspect a message before the model is called. A blocking result stops generation.
• Tool gates inspect a requested tool call before the tool executes. A blocking result prevents the call.
• Output gates inspect the generated response before it is delivered. A blocking result replaces the response with the governance block message.

The gate returns an allow, warn, or block verdict. Assignment enforcement determines how that verdict is applied: log records the result while allowing the pipeline to continue, warn surfaces a warning, and block preserves a blocking verdict.

Output gates and streaming

An enabled output gate requires the engine to buffer the response before delivery. The agent is therefore served non-streamed for that turn, allowing the output gate to redact or block text before any token reaches the client.

Use output gates when a response must be checked before it reaches a channel; use input and tool gates when the risk is in the request or requested action instead.