For security leaders

"An agent did it" is not an answer.

You are accountable for what autonomous software touched, on whose authority, and with what evidence. Govna is built so those three questions have the same answer every time you ask them.

No record, no call Every call leaves a receipt An approval covers one call, not a category

Start free Open the comparison

01 Substance

The four things that actually decide this

Not features — the questions the decision turns on.

Who authorized this?

A named person approved the session — and for anything sensitive, that one call. Their name is on the record.

What could it reach?

Only the tools that login is allowed to use — never the whole surface of a shared credential.

What actually happened?

A record is written before the call and a receipt after it. If the record cannot be written, the call does not happen.

What can we check ourselves?

Open a session, make a call, then read the receipt. Every claim on this page is visible in the product within the first afternoon.

02 Chain of command

One call, end to end

The same seven stages apply no matter which client made the request.

Someone asks

Permission set

Tool

Rules

Outcome

Receipt

01 Someone asksA person asks an agent to do something, starting from a permission set.

Proof ledger

What we verify, on the record.

Every claim chip on this site resolves to one of the records below — the claim, the control behind it, the evidence, and where the claim stops.

Proof record AUD-001

Tool calls fail closed when audit intent cannot be committed.

Control Durable intent is committed before connector dispatch.

Evidence Gateway enforcement and PostgreSQL adapter contract tests

Status Implemented · internally verified

Scope Covers dispatch through the gateway's connector adapters, where intent rows are written before any outbound call.

Limitations Does not cover connectors integrated outside the gateway adapter contract; verified by internal contract tests, not by an independent auditor.

Last reviewed 2026-08-01

Proof record AUD-002

Every dispatched call has correlated intent and terminal receipts.

Control UUIDv7 call correlation across append-only audit events.

Evidence Local PostgreSQL intent/completion integration test

Status Implemented · internally verified

Scope Applies to calls routed through the gateway's audit event pipeline in the reference PostgreSQL deployment.

Limitations Correlation has been exercised in integration tests, not yet under sustained production load or independent review.

Last reviewed 2026-08-01

Proof record TEN-001

Tenant-owned records are isolated in the database.

Control Organization keys, forced RLS, and transaction-local actor context.

Evidence pgTAP RLS policy suite

Status Implemented · internally verified

Scope Covers row-level isolation for organization-scoped tables enforced by PostgreSQL RLS policies.

Limitations Verified by the internal pgTAP suite; does not cover isolation of derived caches, logs, or third-party exports outside the database.

Last reviewed 2026-08-01

Proof record CON-001

Connector updates do not silently expand existing grants.

Control Versioned snapshots pause changed tools and hide new tools.

Evidence Connector drift state-machine tests

Status Implemented · internally verified

Scope Covers connectors registered through the catalog's versioned-snapshot drift detection.

Limitations Detection depends on Govna's own periodic and on-demand discovery requests to the connector; a behavior change that isn't reflected in the tool list returned by the next discovery response is not covered until a later snapshot captures it.

Last reviewed 2026-08-01

Proof record GRD-001

Guardrails can deny, require approval, or safely transform MCP traffic.

Control Default-deny pre/post dispatch pipeline with schema revalidation.

Evidence Guardrail aggregation, SSRF, disclosure, and gateway tests

Status Implemented · internally verified

Scope Covers traffic that passes through the gateway's guardrail pipeline for registered connectors.

Limitations Guardrail coverage is defined by the active policy set; unconfigured tool/argument combinations fall back to default-deny rather than a specific rule.

Last reviewed 2026-08-01

Proof record REC-001

Current recovery objectives are six-hour RPO and four-hour RTO.

Control Daily managed backups plus six-hour encrypted logical exports.

Evidence Recovery configuration and restore-exercise runbook

Status Implemented · internally verified

Scope Applies to the primary production database and its documented restore runbook.

Limitations Objectives reflect the current pilot-stage configuration and runbook exercises; they are not a contractual SLA and may change as scale changes.

Last reviewed 2026-08-01

Proof record PRV-001

Marketing analytics starts disabled until a visitor explicitly accepts, and Do Not Track/Global Privacy Control override any acceptance.

Control Provider-neutral consent policy gates PostHog initialization in the marketing telemetry bootstrap; console's separate analytics gate remains default-on, suppressed only by DNT/GPC.

Evidence Marketing consent controller and browser bootstrap contract tests

Status Implemented · internally verified

Scope Covers PostHog initialization gated by the marketing consent controller in apps/marketing and packages/telemetry; does not change console's separate, default-on analytics gate.

Limitations Depends on the browser correctly reporting DNT/GPC and on local storage being available to persist the consent choice; a storage failure fails closed to disabled analytics rather than enabled.

Last reviewed 2026-08-23

Proof record ARC-001

Historical audit exports use retention-protected object storage.

Control KMS-encrypted S3 Object Lock with dual JSONL/Parquet export.

Evidence OpenTofu plan and archive format tests

Status Implemented · internally verified

Scope Covers the archive export pipeline and its Object Lock bucket configuration as defined in OpenTofu.

Limitations Sandbox organizations are a disclosed exception (ADR-0084) and are excluded from this archive.

Last reviewed 2026-08-01

Proof record WEB-001

Outbound product events use one signed, durable webhook contract.

Control CloudEvents 1.0 outbox delivery with ordering, bounded retry, dead letters, and audited replay.

Evidence pgTAP delivery suite and Rust worker/transport contract tests

Status Implemented · internally verified

Scope Covers webhook subscriptions configured through the outbox delivery worker.

Limitations Bounded retry means delivery is not infinite; events exhausting retries land in the dead-letter queue and require manual or API-triggered replay.

Last reviewed 2026-08-01

Proof record EXT-001

Independent penetration testing is required before production use.

Control Production readiness gate and remediation tracking.

Evidence Pending external engagement

Status Planned · not yet verified

Scope Describes a planned control; no independent penetration test has been completed yet.

Limitations Status is planned, not implemented. Do not represent this as completed or independently verified until the engagement concludes and this record is updated.

Last reviewed 2026-08-01

Proof record PRF-001

Profiles are reusable request templates for connector identities, identity-qualified tools, and duration; every resulting grant and session receives its own authorization and can only narrow those selections.

Control Consent revalidates profile selections against current eligibility and policy ceilings before issuing a session-specific grant.

Evidence Consent profile, multi-identity selection, duration-ceiling, and narrowing contract tests

Status Implemented · internally verified

Scope Covers Govna-owned profiles applied through the consent flow to create grants and governed sessions.

Limitations A profile does not authenticate an agent, hold a connector credential, or grant access by itself; current eligibility and policy are re-evaluated for every authorization.

Last reviewed 2026-08-23

Proof record MCP-001

Govna exposes one Streamable HTTP endpoint whose OAuth authorization flow issues an exact, consent-bound session grant.

Control Environment-bound OAuth metadata, authorization-code PKCE, resource validation, and consent selection precede grant issuance.

Evidence MCP metadata, OAuth PKCE, audience, consent, and reconnect contract tests

Status Implemented · internally verified

Scope Covers the Govna MCP endpoint and its provider-neutral OAuth and consent boundary.

Limitations Client-specific setup screens and availability are controlled by each client; the linked guides must follow the client's current documentation.

Last reviewed 2026-08-23

Proof record APR-001

A step-up approval authorizes or denies one requester-owned exact call rather than a reusable class of future calls.

Control Approval records bind the requester, session, tool, arguments hash, and decision before dispatch resumes.

Evidence Exact-call approval state-machine and authorization tests

Status Implemented · internally verified

Scope Covers calls that the active guardrail policy routes into Govna's approval workflow.

Limitations An approval does not approve later calls, widen the session grant, or override a denial from another policy or authorization boundary.

Last reviewed 2026-08-23

Proof record BIL-001

Govna enforces each organization's configured plan limits and features in the database.

Control Entitlement checks read an organization's configured plan limits and feature flags from the database before allowing usage.

Evidence Billing migrations and entitlement contract tests

Status Implemented · internally verified

Scope Covers database enforcement of an organization's configured plan limits and features in the reference deployment.

Limitations Current configured definitions are non-contractual and may change. Production Stripe price catalog, webhook signing secret, and paid checkout are not configured or qualified.

Last reviewed 2026-08-23

Next step

Where to go next

Two readers, two different next steps.

Review path

Compare this with one shared connection, point by point.

Open the comparison

Everyone else

Start with the words: permission set, session, approved tool list, receipt.

Open the glossary