One governance gate every action passes through.

Governance is the anchor the rest of the platform builds on. The AI runtime can never execute a side-effecting tool directly — it must call back through one governance gate that runs permission, policy, approval, and an append-only audit on every action. There is no bypass, even when a request crosses the service boundary from the runtime to your systems.

Effective permission is computed as the intersection of what the user, the delegated agent, and org policy each allow, and it fails closed on any missing input. Agents inherit the narrowest set of rights, never accumulate authority, and default to deny when anything is ambiguous. Every tool is classified on a risk ladder — read-only, safe-create, controlled-write, destructive — and that tier decides whether an action runs automatically or waits for a person.

Before anything sensitive happens, the agent proposes a plan card and waits. A person explicitly approves, rejects, modifies, or supplies context; approvals are scoped so authority can't leak across agent handoffs, and destructive actions are blocked outright. Every decision is written to an append-only audit trail that records references and IDs only — never raw record content — so an auditor gets a defensible answer without copying sensitive data into the log.