For security leaders

"An agent did it" is not an answer.

You are accountable for what autonomous software touched, on whose authority, and with what evidence. Govna is built so those three questions have the same answer every time you ask them.

No record, no call Every call leaves a receipt An approval covers one call, not a category

Start free Open the comparison

01 Substance

The four things that actually decide this

Not features — the questions the decision turns on.

Who authorized this?

A named person approved the session — and for anything sensitive, that one call. Their name is on the record.

What could it reach?

Only the tools that login is allowed to use — never the whole surface of a shared credential.

What actually happened?

A record is written before the call and a receipt after it. If the record cannot be written, the call does not happen.

What can we check ourselves?

Open a session, make a call, then read the receipt. Every claim on this page is visible in the product within the first afternoon.

02 Chain of command

One call, end to end

The same seven stages apply no matter which client made the request.

Someone asks

Permission set

Tool

Rules

Outcome

Receipt

01 Someone asksA person asks an agent to do something, starting from a permission set.

Proof ledger

What we verify, on the record.

Every claim chip on this site resolves to one of the records below — the claim, the control behind it, the evidence, and where the claim stops.

Proof record AGT-001

Registered agents are attributed through authenticated OAuth client bindings.

Control Organization-scoped immutable keys and one-time authenticated client bindings; current lifecycle checks precede dispatch.

Evidence ADR-0209/ADR-0210 and forward migrations 202610090001/202610090002; PostgreSQL agent registry and session/receipt attribution contract tests; Gateway agent authorization, same-label isolation, retirement and durable call correlation tests; Control-plane GraphQL and console registration contracts

Status Planned · not yet verified

Scope Authenticated OAuth client bindings select organization-owned agent IDs for session/call attribution. Duplicate software labels remain distinct; unbound clients retain explicit registered-agent policy behavior. Agent registration grants no access: session grants, connector identities, tools, duration and narrowing authorization remain separate. Retirement denies only that organization's binding.

Limitations Source contract tests do not establish production operation. Protected migration/deployment and the live two-client Paperclip grant, refresh, approval and retirement pilot remain pending. Current labels are display aids; opaque call correlation metadata is not independent cryptographic verification and excludes prompts, arguments, results, secrets and personal data.

Last reviewed 2026-10-09

Proof record AUD-001

Tool calls fail closed when audit intent cannot be committed.

Control Durable intent is committed before connector dispatch.

Evidence Gateway enforcement and PostgreSQL adapter contract tests

Status Implemented · internally verified

Scope Covers dispatch through the gateway's connector adapters, where intent rows are written before any outbound call.

Limitations Does not cover connectors integrated outside the gateway adapter contract; verified by internal contract tests, not by an independent auditor.

Last reviewed 2026-08-01

Proof record AUD-002

Every dispatched call has correlated intent and terminal receipts.

Control UUIDv7 call correlation across append-only audit events.

Evidence Local PostgreSQL intent/completion integration test

Status Implemented · internally verified

Scope Applies to calls routed through the gateway's audit event pipeline in the reference PostgreSQL deployment.

Limitations Correlation has been exercised in integration tests, not yet under sustained production load or independent review.

Last reviewed 2026-08-01

Proof record TEN-001

Tenant-owned records are isolated in the database.

Control Organization keys, forced RLS, and transaction-local actor context.

Evidence pgTAP RLS policy suite

Status Implemented · internally verified

Scope Covers row-level isolation for organization-scoped tables enforced by PostgreSQL RLS policies.

Limitations Verified by the internal pgTAP suite; does not cover isolation of derived caches, logs, or third-party exports outside the database.

Last reviewed 2026-08-01

Proof record CON-001

Connector updates do not silently expand existing grants.

Control Versioned snapshots pause changed tools and hide new tools.

Evidence Connector drift state-machine tests

Status Implemented · internally verified

Scope Covers connectors registered through the catalog's versioned-snapshot drift detection.

Limitations Detection depends on Govna's own periodic and on-demand discovery requests to the connector; a behavior change that isn't reflected in the tool list returned by the next discovery response is not covered until a later snapshot captures it.

Last reviewed 2026-08-01

Proof record GRD-001

Guardrails can deny, require approval, or safely transform MCP traffic.

Control Default-deny pre/post dispatch pipeline with schema revalidation.

Evidence Guardrail aggregation, SSRF, disclosure, and gateway tests

Status Implemented · internally verified

Scope Covers traffic that passes through the gateway's guardrail pipeline for registered connectors.

Limitations Guardrail coverage is defined by the active policy set; unconfigured tool/argument combinations fall back to default-deny rather than a specific rule.

Last reviewed 2026-08-01

Proof record REC-001

Current recovery objectives are six-hour RPO and four-hour RTO.

Control Daily managed backups plus six-hour encrypted logical exports.

Evidence Recovery configuration and restore-exercise runbook

Status Implemented · internally verified

Scope Applies to the primary production database and its documented restore runbook.

Limitations Objectives reflect the current pilot-stage configuration and runbook exercises; they are not a contractual SLA and may change as scale changes.

Last reviewed 2026-08-01

Proof record PRV-001

Marketing analytics starts disabled until a visitor explicitly accepts, and Do Not Track/Global Privacy Control override any acceptance.

Control Provider-neutral consent policy gates PostHog initialization in the marketing telemetry bootstrap; console's separate analytics gate remains default-on, suppressed only by DNT/GPC.

Evidence Marketing consent controller and browser bootstrap contract tests

Status Implemented · internally verified

Scope Covers PostHog initialization gated by the marketing consent controller in apps/marketing and packages/telemetry; does not change console's separate, default-on analytics gate.

Limitations Depends on the browser correctly reporting DNT/GPC and on local storage being available to persist the consent choice; a storage failure fails closed to disabled analytics rather than enabled.

Last reviewed 2026-08-23

Proof record ARC-001

Historical audit exports use retention-protected object storage.

Control KMS-encrypted S3 Object Lock with dual JSONL/Parquet export.

Evidence OpenTofu plan and archive format tests

Status Implemented · internally verified

Scope Covers the archive export pipeline and its Object Lock bucket configuration as defined in OpenTofu.

Limitations Sandbox organizations are a disclosed exception (ADR-0084) and are excluded from this archive.

Last reviewed 2026-08-01

Proof record WEB-001

Outbound product events use one signed, durable webhook contract.

Control CloudEvents 1.0 outbox delivery with ordering, bounded retry, dead letters, and audited replay.

Evidence pgTAP delivery suite and Rust worker/transport contract tests

Status Implemented · internally verified

Scope Covers webhook subscriptions configured through the outbox delivery worker.

Limitations Bounded retry means delivery is not infinite; events exhausting retries land in the dead-letter queue and require manual or API-triggered replay.

Last reviewed 2026-08-01

Proof record EXT-001

Independent penetration testing is required before production use.

Control Production readiness gate and remediation tracking.

Evidence Pending external engagement

Status Planned · not yet verified

Scope Describes a planned control; no independent penetration test has been completed yet.

Limitations Status is planned, not implemented. Do not represent this as completed or independently verified until the engagement concludes and this record is updated.

Last reviewed 2026-08-01

Proof record PRF-001

Profiles are reusable request templates for connector identities, identity-qualified tools, and duration; every resulting grant and session receives its own authorization and can only narrow those selections.

Control Consent revalidates profile selections against current eligibility and policy ceilings before issuing a session-specific grant.

Evidence Consent profile, multi-identity selection, duration-ceiling, and narrowing contract tests

Status Implemented · internally verified

Scope Covers Govna-owned profiles applied through the consent flow to create grants and governed sessions.

Limitations A profile does not authenticate an agent, hold a connector credential, or grant access by itself; current eligibility and policy are re-evaluated for every authorization.

Last reviewed 2026-08-23

Proof record MCP-001

Govna exposes one Streamable HTTP endpoint whose OAuth authorization flow issues an exact, consent-bound session grant.

Control Environment-bound OAuth metadata, authorization-code PKCE, resource validation, and consent selection precede grant issuance.

Evidence MCP metadata, OAuth PKCE, audience, consent, and reconnect contract tests

Status Implemented · internally verified

Scope Covers the Govna MCP endpoint and its provider-neutral OAuth and consent boundary.

Limitations Client-specific setup screens and availability are controlled by each client; the linked guides must follow the client's current documentation.

Last reviewed 2026-08-23

Proof record APR-001

A step-up approval authorizes or denies one requester-owned exact call rather than a reusable class of future calls.

Control Approval records bind the requester, session, tool, arguments hash, and decision before dispatch resumes.

Evidence Exact-call approval state-machine and authorization tests

Status Implemented · internally verified

Scope Covers calls that the active guardrail policy routes into Govna's approval workflow.

Limitations An approval does not approve later calls, widen the session grant, or override a denial from another policy or authorization boundary.

Last reviewed 2026-08-23

Proof record BIL-001

Govna enforces each organization's configured plan limits and features in the database.

Control Entitlement checks read an organization's configured plan limits and feature flags from the database before allowing usage.

Evidence Billing migrations and entitlement contract tests

Status Implemented · internally verified

Scope Covers database enforcement of an organization's configured plan limits and features in the reference deployment.

Limitations Current configured definitions are non-contractual and may change. Production Stripe price catalog, webhook signing secret, and paid checkout are not configured or qualified.

Last reviewed 2026-08-23

Proof record THR-001

A pending connector tool's description is scanned for hidden Unicode control/format/bidi characters and phrases addressed to the model, and diffed against the previously approved description and schema before an administrator reviews it.

Control A deterministic detector runs at connector discovery time and its matched reason codes, never the matched text, are recorded on the review record, the review CloudEvent, and the connector detail page.

Evidence govna-guardrails hidden-instruction detector and diff unit tests; Connector snapshot review PostgreSQL contract tests; Console GraphQL connector review contract tests

Status Implemented · internally verified

Scope Covers tool descriptions discovered through the connector snapshot pipeline and surfaced on the pending-review data reviewers see before approval.

Limitations Detection is deterministic phrase and hidden-character matching, not a machine-learning classifier; it narrows reviewer attention and does not itself deny or approve a snapshot. A tool remains hidden or paused pending manual approval regardless of this signal, per the existing connector drift review flow.

Last reviewed 2026-09-10

Proof record THR-002

Identical or visually confusable tool names exposed by two different connectors are detected and surfaced as a warning, both at connector review time and in the live tools list an agent receives.

Control A pure normalization function (case folding, Unicode NFKC, a curated Latin/Cyrillic/Greek homoglyph table, and hyphen/underscore/whitespace collapsing) groups tool identities across connectors; collisions across more than one connector are flagged.

Evidence govna-guardrails shadowing normalization and detection unit tests; Connector snapshot review PostgreSQL contract tests; Console GraphQL connector review contract tests

Status Implemented · internally verified

Scope Covers tool names known to Govna's connector catalog for an organization; detection groups the connector being reviewed against every other enabled connector's latest approved snapshot.

Limitations The homoglyph table covers common Latin lookalikes in Cyrillic and Greek scripts, not a complete Unicode confusables database. Shadowing is a warning, not an automatic block: dispatch still resolves by the identity-qualified provider name, which remains unambiguous even when two tools shadow each other.

Last reviewed 2026-09-10

Proof record THR-003

A tool result containing instruction-like content addressed to the model rather than the human reader can be flagged or withheld before it reaches the agent.

Control A built-in post-dispatch guardrail scans every string in a tool result with the same deterministic hidden-instruction detector used for description integrity; the organization configures ignore, flag (default), or deny, and matched reason codes and locations, never the result text, are recorded on the decision.

Evidence govna-guardrails result-injection evaluate_builtin contract tests; guardrails/catalog.json verification script and Vitest suite

Status Implemented · internally verified

Scope Covers tool results evaluated through the built-in guardrail pipeline's post-dispatch phase.

Limitations Matching is deterministic phrase and hidden-character detection, not a machine-learning classifier, and can miss novel phrasing or match benign content that happens to contain a listed phrase; the default action is to flag and record rather than to deny.

Last reviewed 2026-09-10

Proof record THR-004

Private, loopback, link-local, and cloud metadata-service destinations are blocked by default for any tool argument that names a URL or host, and an organization can configure an explicit allow-list of hostnames, domain suffixes, and CIDR ranges per tool.

Control A built-in pre-dispatch guardrail identifies URI/host-shaped arguments from the tool's approved schema and argument names, then evaluates the destination against the organization's configured allow-list or, absent one, the always-on private-range default-deny.

Evidence govna-guardrails destination allow-list unit and evaluate_builtin contract tests; govna-net public/private address classification unit tests

Status Implemented · internally verified

Scope Covers arguments a tool's approved input schema types as a URI/host, or whose property name matches a documented heuristic list, evaluated before dispatch.

Limitations Evaluation is a syntactic check on the literal argument value and does not resolve DNS, so it cannot detect a domain name that later resolves to a private address at connection time; the connector's own pinned outbound transport boundary is the control that resolves and pins the actual connection.

Last reviewed 2026-09-10

Next step

Where to go next

Two readers, two different next steps.

Review path

Compare this with one shared connection, point by point.

Open the comparison

Everyone else

Start with the words: permission set, session, approved tool list, receipt.

Open the glossary