Governance Service Overview

Governance Service is the platform service behind projects, policies, controls, declarations, reviews, indicators, activity logs, attachments, and credential coordination.

Most users experience Governance Service through Guardian. Integrators use it when they need to send governance events, connect automated checks, or integrate platform workflows into another system.

What Governance Service Owns

• Projects and project metadata
• Policies in the Policy Library and applied to projects
• Controls, declarations, reviews, and attached evidence
• Indicators, evaluations, and generated declarations
• Governance Programs, agent assessments, and agent certifications
• Credential issuance and revocation coordination with the Integrity Service
• Report generation coordination with PDFGen
• Activity logs

What Governance Service Depends On

Governance Service relies on Auth Service for authentication and authorization, configured object storage for attachments, Integrity Service for signed governance records and credentials, PDFGen for reports, the Control Plane for agent assessments and for attaching agent certifications to the gateway, and deployment-provided platform storage for durable state.

Integrity Service backs most governance writes: creating projects, creating or applying policies, submitting declarations, reviews, and attachments, exporting reports, and issuing or revoking credentials all fail while it is unavailable. If another dependency is unavailable, affected workflows may be hidden, delayed, or return an operational error.

User-Facing Principles

• Project context: Governance data is scoped to the selected project unless a workflow is explicitly organization-wide.
• Roles and permissions: Users can only perform actions allowed by their project or organization role.
• Explainable evidence: Declarations, reviews, attachments, indicators, and credentials should create a record that auditors can understand later.
• Human review: Automation supports the control workflow but does not replace reviewer judgment.

Where to Go Next

• Use the Guardian guides for end-user workflows.
• Use the Governance Service API reference for exact request and response shapes.
• Use Deployment Process for platform configuration and operational readiness.

Related

• Governance Service Architecture — how it works with Auth Service, Integrity Service, report generation, and storage
• Governance Service Authentication and RBAC — how requests are authenticated and which roles gate each action
• Governance Service Configuration — the connections and storage an operator must configure
• Governance Service Operations — readiness probes, upgrade preparation, and symptom checks
• Integrity Service Overview — the service behind credential and lineage workflows
• Control Plane Overview — the agent registry behind assessments and certifications