CAIN Governance

Organizational rules, authorities, and approval workflows for autonomous AI agents.

What is CAIN Governance?

CAIN Governance answers: What autonomous systems are allowed to do, under whose authority, under which rules, with what approvals, exceptions, scope, and audit history?

CAIN Governance sits ABOVE individual policies and coordinates organizational rules.

Policy - Is this specific action allowed? (per-action evaluation)
Governance - What rules, authorities, constraints, approvals, and lifecycle controls govern this agent/system?
Control - Runtime enforcement (kill switches, tool permissions)
Budget - Financial governance (hard spending limits)

Quick Start

# 1. Create a governance policy
curl -X POST https://cainstudio.online/fabric/governance/policies \
  -H "X-Tenant-ID: your-tenant" \
  -H "Content-Type: application/json" \
  -d '{"name":"Production Deployment Controls","priority":50,"constraints":[{"type":"require_approval","action":"deploy"}]}'

# 2. Activate the policy
curl -X POST https://cainstudio.online/fabric/governance/policies/{policy_id}/activate \
  -H "X-Tenant-ID: your-tenant"

# 3. Create an authority
curl -X POST https://cainstudio.online/fabric/governance/authorities \
  -H "X-Tenant-ID: your-tenant" \
  -H "Content-Type: application/json" \
  -d '{"identity_id":"user:alice","role":"deployment-approver","can_approve":true}'

# 4. Request approval
curl -X POST https://cainstudio.online/fabric/governance/approvals \
  -H "X-Tenant-ID: your-tenant" \
  -H "Content-Type: application/json" \
  -d '{"requester_id":"agent-123","action":"deploy","resource":"production","justification":"Deploying v2.1"}'

# 5. Evaluate governance
curl -X POST https://cainstudio.online/fabric/governance/evaluate \
  -H "X-Tenant-ID: your-tenant" \
  -H "Content-Type: application/json" \
  -d '{"identity_id":"user:alice","action":"deploy","resource":"production"}'

API Endpoints

Method	Path	Description
GET	/fabric/governance/policies	List governance policies
POST	/fabric/governance/policies	Create governance policy
GET	/fabric/governance/policies/{id}	Get policy details
PATCH	/fabric/governance/policies/{id}	Update policy
POST	/fabric/governance/policies/{id}/activate	Activate policy
POST	/fabric/governance/policies/{id}/deactivate	Suspend/retire policy
GET	/fabric/governance/authorities	List authorities
POST	/fabric/governance/authorities	Create authority
POST	/fabric/governance/approvals	Request approval
POST	/fabric/governance/approvals/{id}/decide	Approve/deny
POST	/fabric/governance/evaluate	Evaluate governance
GET	/fabric/governance/decisions	List decisions
GET	/fabric/governance/audit	Audit log

CLI

cain governance list
cain governance show {policy_id}
cain governance create --name "My Policy" --priority 100
cain governance activate {policy_id}
cain governance suspend {policy_id}
cain governance retire {policy_id}
cain governance approve {approval_id} --reason "Approved"
cain governance deny {approval_id} --reason "Denied"
cain governance audit --limit 50

Security Model

Tenant isolation: Every operation requires X-Tenant-ID. Cross-tenant access returns 404.
Fail-closed: UNKNOWN and ERROR verdicts always become DENY.
Identity-bound: Approvals are bound to authority identity, not request parameters.
Exception expiration: Exceptions MUST expire. No permanent bypass.
Audit trail: Every lifecycle event is recorded with actor, target, and timestamp.
Versioned: Historical decisions identify the governance version that applied.

Integration

CAIN Governance integrates with:

CAIN Identity: Authority resolution, revocation checking
CAIN Policy: Policy version tracking, decision correlation
CAIN Budget: Budget requirement constraints
CAIN Control: Runtime enforcement, kill switches
CAIN Trace: Decision correlation, trace_id tracking
CAIN Evidence: Audit log, governance decisions

What is CAIN Governance?

Quick Start

Lifecycle

API Endpoints

CLI

Security Model

Integration