Governance Programs

About Governance Programs

A Governance Program is your organization’s standard for certifying an individual agent. Where a policy is applied to a project, a program is applied to one agent at a time: the agent’s owner starts an assessment of the agent against the program, a reviewer judges each of its controls, and an assessment that passes earns the agent a certification the Agent Gateway can enforce. Programs never involve a project.

A program is made of:

• Program details: its name, version, description, how long its certifications last, and the parts of an agent’s configuration a certification binds
• Controls: the requirements an agent must meet

Programs, the Assessments page, and an agent’s Operating Profile, Assessments and Certification pages appear when agent certification is turned on for your deployment. With it on, the sidebar’s Policy Library becomes Library, holding Policies and Programs.

Key actions associated with programs include:

• Creating a program
• Publishing a new version
• Assigning reviewers
• Viewing programs
• Seeding programs from the program library

Creating a program

Creating a program, publishing its versions, and assigning its reviewers need the Manage Governance Programs permission, which only Organization Owners hold. Every member of the organization can view programs and start an assessment against one.

To create a program:

1. In the sidebar, select Library, then Programs
2. Select Create Program
3. Select Start Fresh, which starts the program at v1.0.0
4. Complete the Program Details step and select Continue
5. Complete the Controls step, using Add Control for each additional control, and select Continue
6. Review the program and select Create Program

The Guardian Platform registers the program’s manifest, the frozen record of its details and controls, with the Integrity Service, which gives it a Manifest CID. Certifications name the program version by that CID, and the gateway requires certifications under a program by it.

Program details

• Program Name: The name that identifies the program, up to 200 characters. Every version of a program shares its name, and the name gives the program its slug.
• Version: A semantic version such as 1.0.0, with no leading v and no build metadata (+...). A new version must be higher than every existing version of the program.
• Description: What a certification under the program attests, and which agents it is for.
• Certification Lifetime: How long a certification under this version stays valid, counted from the last review that passed the assessment. Choose No expiry, a preset, or Custom duration, an ISO 8601 duration such as P18M or P90D.
• Configuration Scope: The fields an agent’s configuration must capture before an assessment can pin it, such as Permissions, Skills, Config files or App, so none of them can change without changing the configuration. Choose at least one. Agent definition heads the fields a custom agent’s definition fixes: ticking it requires the definition and every field beneath it, and unticking any of them unticks it. App sits apart, since a definition doesn’t hold it. A certification names the whole configuration, so a change to anything it captures, in scope or not, gives the agent a configuration the certification doesn’t cover.

An assessment can pin only a configuration that captured every field in the program’s scope, since a field that isn’t captured could change without changing the configuration. What gets captured depends on the agent:

A scope that requires a field an agent doesn’t capture refuses every agent of that kind, so a scope with Permissions or Skills refuses OpenCode and OpenClaw agents. A scope with MCP servers refuses a Claude Code or Codex agent until it runs a Viper version that records them. See Agent Configuration for what Viper captures.

Controls

Each control is one requirement an agent must meet. A program needs at least one control.

• Title: A short name for the control.
• Control Code: A code unique within the program, using letters and numbers with single hyphens or periods between them, such as AGT-1. Codes are stored in upper case.
• Requirement: What an agent must show to meet the control.
• Guidance: Optional help for the agent’s owner and reviewers in interpreting the requirement, added with Add Guidance.
• Expected Evidence: What the owner is expected to declare, such as “The model card for the agent’s model,” added one item at a time with Add Expected Evidence. It guides the owner and the reviewer; nothing checks it.
• Also Judged Against: What the reviewer weighs besides the owner’s declarations: sections of the agent’s operating profile (Purpose, Context, Systems, Excluded), and fields of the pinned configuration. Each configuration field must be in the program’s Configuration Scope. A control with no expected evidence that is judged only against configuration fields or profile sections needs no declaration: the pinned configuration addresses it once it captured those fields, and the pinned profile while one is pinned.

More Options holds the rest, and shows a one-line summary of them while it’s closed:

• Applies To: Every agent, or Agents with an operating profile that matches any of these, such as agents that touch personal data. It tells owners and reviewers which agents the control is meant for.
• Not Applicable When: The condition under which the owner may claim the control doesn’t apply, such as “The agent never handles personal data.” Leave it empty if every assessment must address the control. A reviewer still judges whether the claim holds. At least one control must leave it empty, so no assessment can waive every control.
• Citations: The standards or frameworks the control derives from.

Publishing a new version

A program version can’t be edited. To change a program, publish its next version: the new version is a new, immutable program with the same name and slug and a higher version number. Assessments already started stay judged against the version they started on, and certifications already issued keep naming theirs.

A version is addressed as slug@version, such as coding-agent-baseline@1.1.0, and in the API as slug:coding-agent-baseline@1.1.0.

To publish a new version:

1. In the sidebar, select Library, then Programs
2. Open the program at the version to start from, then select New Version. Alternatively, select Create Program, then From Existing Program, and choose the program, which starts from its latest version.
3. The new version starts from that version’s details and controls. Version is prefilled with the next minor release after the program’s latest version, and Program Name is locked. Adjust Version if needed and make your changes, selecting Continue after each step
4. Select Create Version

A gateway that requires certifications under the earlier version’s Manifest CID keeps requiring that version. Add the new version’s CID to the gateway’s plugin settings once agents hold certifications under it. See Agent Certifications.

Assigning reviewers

A program’s reviewers review the assessments started against it. An assignment covers every version of the program, including versions published later. A reviewer can’t review an assessment they started or a submission they made, so assign at least one reviewer other than the members who will assess their own agents. Whoever started an assessment can’t issue its certification either, even as an Organization Owner. An Organization Owner who assesses their own agents therefore needs a reviewer who can sign, so the passing verdict issues the certification, or a second Organization Owner to issue it.

Whether a reviewer’s passing verdict issues the certification right away depends on their role: the certification is signed with the platform key on their behalf, which an Audit Owner, Organization Owner or Project Owner can do. See Agent Assessments.

To assign reviewers:

1. In the sidebar, select Library, then Programs
2. Select the program, then Reviewers in its sidebar
3. Select Assign Reviewers
4. Choose one or more active members of the organization under Members
5. Select Assign Reviewer, or Assign n Reviewers for several

To remove a reviewer, open the actions menu on their row, select Remove Reviewer, and type their name to confirm. Removal takes effect on their next request. The reviews they already made stand, and setting Status to Removed lists past reviewers with when they were removed. Search the list by name or email, filter it by who assigned or removed each reviewer, and sort it by any column.

Organization Owners and the program’s reviewers can see a program’s reviewers.

Viewing programs

Library → Programs lists your organization’s programs, one entry per program showing its latest version. Search by name, description, version, or a control’s code or title, and filter by configuration scope.

Selecting a program opens its latest version. Its Overview shows its Manifest CID (Program CID), certification lifetime, configuration scope and controls, and its Reviewers lists who reviews it. Use the version selector to open an earlier version, which shows a banner with a link to the latest, and the program’s name at the top of its sidebar to switch programs.

Seeding programs from the program library

EQTY Lab maintains a program library, ready-made programs for certifying Claude Code and Codex agents, in tools/program-library of the Guardian Platform repository:

Certify an agent against the baseline and whichever of the others match how it runs. The library’s scopes use only what Claude Code and Codex capture.

Its script, seed_program_library.py, creates the programs in your organization and can assign their reviewers. Point GOVERNANCE_API_URL at your Governance Service, which is your platform host followed by /governanceService, and set GOVERNANCE_API_KEY to an Organization Owner’s sign-in token, or their API key with the Manage Governance Programs scope and Organization access. Assigning reviewers with --reviewers looks each one up with that key, which takes a sign-in token or a full-access key:

uv run tools/program-library/seed_program_library.py --dry-run
uv run tools/program-library/seed_program_library.py --reviewers <user ID or did:key>

--dry-run shows what seeding would create without changing anything. Seeding is idempotent per program and version: a version that already exists is reused, so to publish a change, raise the version in the program’s file. The library’s README lists every option.

Related

• Agent Assessments — assess an agent against a program version
• Agent Certifications — what a passing assessment issues, and how the gateway enforces it
• Agent Configuration — the configuration fields a program’s scope binds
• Roles and Permissions — who holds Manage Governance Programs
• Policies — the project-level counterpart to a program