Governance

Governance lets you enforce compliance, security, and quality standards across your Strongly AI workloads. Define policies with staged requirements, group workloads into solutions, gate deployments until requirements are met, configure AI guardrails, and maintain an audit trail for regulatory requirements.

Governance lives in the sidebar under Governance, with three pages: Solutions (group your workloads, apply policies, and track compliance), Policies, and Reviews. Administrators additionally have an audit trail viewer at /governance/audit.

Core Capabilities

Capability	Description
Policy Management	Define and version policies as ordered stages with form fields, gates, and gated resource types
Stages & Reviews	Stage requirements reviewed by user, role, or group reviewers with Any/All/Majority approval logic
Solutions	Group related workloads and apply policies for unified compliance tracking
Evidence	File uploads attached to gate submissions, downloadable by reviewers and auditors
AI Guardrails	PII filtering, toxicity and prompt injection detection, rate limiting, and more for AI Gateway models
Enforcement	Deploy-time compliance checks that block workloads with pending or failed requirements
Audit Trail	Immutable record of every governance action with before/after state capture
Notifications	In-app and optional email notifications for gate submissions and review decisions
EU AI Act	Guidance for mapping EU AI Act obligations onto policies, gates, and guardrails

Governable Resource Types

Policy stages gate deployments by resource type. A stage's Gated Resource Types setting selects which of these it blocks:

Resource Type	Key	Description
Applications	app	Deployed marketplace and custom applications
Add-ons	addon	Managed database and infrastructure services
Workflows	workflow	Automation and AI agent workflows
Data Sources	dataSource	External database and API connections
ML Models	mlModel	ML Registry models and experiments
AI Gateway Models	aiGatewayModel	LLM and generative AI models
Workspaces	workspace	Collaborative team workspaces
Projects	project	Project containers for resources

Gating is cumulative: once a stage gates a resource type, it stays gated in all later stages. See Enforcement for how the deploy-time check works.

Getting Started

1. Create Your First Policy

Navigate to Governance > Policies and click Create Policy. The Policy Builder is a single page where you define the policy details (name, description, category, severity), add ordered stages with form fields, gates, and gated resource types, and set the policy Active and Published. See Policies for step-by-step instructions.

2. Group Workloads into a Solution

Navigate to Governance > Solutions and click Create Solution. Name the solution, pick the workloads it covers from the workload picker, and select the policies to apply. See Compliance.

3. Complete Requirements

Open the solution's detail page to see its compliance progress. Each applied policy's required fields and gates appear as requirement forms: fill in fields, tick acknowledgments, submit metrics, upload evidence, and request approvals. Requirement statuses move through pending, satisfied, failed, or waived (administrators can waive a requirement with a documented reason).

4. Review and Approve

Reviewers see pending approval gates on the Governance > Reviews page and can Approve or Deny (a denial requires a comment). See Stages & Reviews.

5. Configure AI Guardrails

For AI Gateway models, configure guardrail rules such as PII filtering, toxicity detection, prompt injection protection, and rate limiting. Guardrail gates in policies verify that the required guardrails are configured on the model. See Guardrails.

6. Deploy

When a gated workload is deployed, the platform checks every solution that contains it. Pending or failed requirements block the deploy, and the blocked-deploy dialog lists exactly what remains so it can be resolved inline. See Enforcement.

Access Control

Action	Who Can Do It
Edit or delete a policy	The policy creator or an administrator; a policy in use by solutions cannot be deleted
See a policy	The creator, users it is shared with, and administrators; active published policies are visible in your organization so they can be applied
Submit gates or modify a solution	The solution owner, shared users, or an administrator
Approve or deny approval gates	The configured reviewers; administrators can always decide, and can overturn a decision (marked as an admin override in the audit trail)
Waive a requirement	Administrators only, with a documented reason
View the audit trail	Administrators only

Reviewer Types

Approval gates assign reviewers by three mechanisms:

Type	Format	Best For
User	Specific user ID	Designated reviewers, compliance officers
Role	Role name (e.g., admin)	Flexible team assignments
Group	org:<orgId> (any active member) or org:<orgId>:role:<memberRole>	Cross-team approvals, committee reviews

Regulatory Frameworks

Policies are a general mechanism: model a framework's obligations as stages and gates, and the platform tracks completion and keeps the evidence trail. Common targets include SOC 2, HIPAA, GDPR, ISO 27001, ISO 42001, PCI DSS, NIST AI RMF, and the EU AI Act. See Regulatory Compliance and the EU AI Act guide.

Navigation

Page	Path	Description
Solutions	/governance/solutions	Manage solutions (also the Governance landing page)
Create Solution	/governance/solutions/new	Pick workloads and policies for a new solution
Solution Detail	/governance/solutions/<id>	Compliance progress, requirement forms, evidence
Policies	/governance/policies	Browse and manage policies
Policy Builder	/governance/policies/new	Create a policy (editing uses /governance/policies/<id>/edit)
Reviews	/governance/reviews	Approve or deny pending approval gates
Audit Log	/governance/audit	Audit trail viewer (administrators only)

Best Practice

Introduce gating progressively: start with stages that gate nothing (information gathering only), then add gated resource types to the stages that matter once your team is comfortable with the workflow.