New One-call approvals are live in the console
Govna
Start free
Rules

Four things a rule can do. None of them is 'allow more'.

Every call passes a checkpoint you configure. A rule can let it through, block it, hold it for a person, or trim what goes out and comes back. A rule can never hand an agent access it was not already given.

Rules can only restrict, never expand
Start free
The checkpoint

One call at a time, sorted

Same agent, same session — four different calls, four different answers.

Agent askssearch_records
checkpoint
Goes throughNothing matched. The call goes out and a receipt comes back.
Sent for approvalA write. Held until a named person says yes to this one call.
TrimmedAllowed, but the result comes back with personal fields removed.
BlockedRefused before it reaches the app. Nothing was sent.
02 When checks run

Before the call, and after it

Blocking a bad request matters. So does catching what comes back — a read that returns more than it should is still a leak.

Rules can only restrict, never expand
01 When a tool list is approved Decide what may be reachable at all, before anyone can pick it.
02 Before a call goes out Let it through, block it, or hold it for a person.
03 After the result comes back Trim out fields the person asking should not see.
03 Your stack

Enforce the AI security vendor you already bought

Govna is the enforcement point, not another scanner. Point a rule at the provider your security team already chose — or at your own signed HTTPS endpoint — and its verdict decides whether the call goes out. A provider can only narrow access, and a provider that cannot answer fails closed.

LakeraAmazon Bedrock GuardrailsMicrosoft PurviewPrisma AIRSGoogle Model ArmorAzure AI Content SafetyCrowdStrike AIDRHiddenLayerZscaler AI GuardPresidioGuardrails AIPangea AI GuardAim SecurityNoma SecurityLasso SecurityPillar Security and 16 more
04 Built in

Ten checks you do not have to buy

Enough to survive a first review without adding a vendor.

Allow and deny rules Name the tools and values that are simply never allowed.
Step-up approval Route a call to a named person instead of refusing it.
Secret detection Catch credentials in what is sent or returned. Findings keep the location, never the value.
Personal data rules Deterministic rules that redact personal fields on the way back.
Rate limits Stop a runaway agent before it becomes an incident.
Execution schedules Some tools should only be reachable during working hours.
Output limits Withhold a result too large to be a legitimate read.
Tool-list drift A tool that changed since approval stops until it is reviewed again.
Schema validation Reject a call whose arguments do not match the approved shape.
Authorization policy Default deny, evaluated against the approval behind this session.
Next step

Where to go next

Two readers, two different next steps.

Security leader

See how the controls hold up in a review.

Platform engineer

Connect any client to the same address.