Governance

Deterministic Gating

Agents built on Anthropic, OpenAI, or Gemini route their action requests through our existing API. Deterministic policy gates then apply before any write, workflow transition, or approval state can commit.

ConnectWork already governs who an agent may act for; gating governs whether a specific action is allowed to commit.

swaps every example

How this fits with Agent Ops

Agent Ops shows which Policy Artifact is active, which rules fired, and which version is live. This API lets developers create, test, replay, and publish the same policy artifacts.

Enforcement is a checkpoint, not an opt-in call. The gate sits on the write/commit path. The API is for authoring policy and submitting action proposals for evaluation — an agent cannot route around the gate by declining to call it.

§1

Policy Artifact — policy-as-data

Create, version, and retrieve deterministic policy as a typed object. Policy Artifacts can be attached to Agent Recipes and Work Product Contracts.

POST/v2/gating/policy-artifacts
GET/v2/gating/policy-artifacts/{id}
GET/v2/gating/policy-artifacts/{id}/versions

Draft→

In review→

Replay passed→

Active→

Rolled back

Transition to Active is blocked unless the EvalPack passes. GET …/versions returns history; rollback re-activates a prior version.

policy_artifact

{
  "id": "finance_credit_v1",
  "object": "policy_artifact",
  "vertical": "finance",
  "version": 3,
  "status": "active",
  "owner": "RevOps Policy Admin",
  "evalpack_id": "finance_credit_eval_v7",
  "runtime_mode": "advisory_hitl_writes",
  "rules": [
    {
      "id": "discount_authority",
      "type": "approval_threshold",
      "severity": "block",
      "description": "Discount exceeding delegated authority requires Credit Officer approval.",
      "parameters": {
        "authority_by_role": {
          "account_executive": 0.1,
          "regional_manager": 0.15,
          "vp_sales": 0.25
        },
        "escalation_approver": "credit_officer"
      }
    },
    {
      "id": "legal_approval",
      "type": "missing_approver",
      "severity": "block",
      "description": "Non-standard terms require Legal approval before final approval.",
      "parameters": {
        "required_approver": "legal",
        "trigger": "non_standard_terms"
      }
    },
    {
      "id": "permission_boundary",
      "type": "permission_gate",
      "severity": "block",
      "description": "Agent may only use content the requesting user can access; restricted sources are acknowledged as unavailable, never summarized.",
      "parameters": {
        "mode": "user_scoped"
      }
    },
    {
      "id": "pre_commit_freshness",
      "type": "freshness_gate",
      "severity": "block",
      "description": "Blocks approval if the work product is already stale at commit time. Ongoing post-commit stale propagation belongs to Revalidation.",
      "parameters": {
        "watched_sources": [
          "pricing_policy",
          "forecast_memo",
          "legal_terms"
        ]
      }
    }
  ]
}

§2

Evaluate — the gate as a service

POST /v2/gating/evaluate is the pre-commit evaluation endpoint. The platform invokes it automatically on action proposals; developers can also call it for preflight checks.

Firings report result and blocks_commit — no ambiguous passed field.

POST/v2/gating/evaluate

Idempotency-Key: action_123
X-ConnectWork-Actor: dana
{
  "policy_artifact_id": "finance_credit_v1",
  "actor": {
    "user": "dana",
    "role": "regional_manager"
  },
  "work_product": {
    "type": "deal_brief",
    "requested_discount": 0.2,
    "terms": "non_standard_indemnity",
    "sources": [
      "deal_brief",
      "pricing_policy"
    ]
  }
}

200 OK · compliance_trace

{
  "object": "compliance_trace",
  "policy_artifact_id": "finance_credit_v1",
  "policy_artifact_version": 3,
  "approval_ready": false,
  "firings": [
    {
      "rule_id": "discount_authority",
      "result": "BLOCK",
      "blocks_commit": true,
      "threshold": {
        "requested_discount": 0.2,
        "delegated_authority": 0.15
      },
      "user_safe_explanation": "You can approve up to 15%. A 20% discount requires Credit Officer approval."
    },
    {
      "rule_id": "legal_approval",
      "result": "NOT_APPROVAL_READY",
      "blocks_commit": true,
      "detail": "Non-standard indemnity clause detected; Legal approval missing."
    },
    {
      "rule_id": "permission_boundary",
      "result": "PARTIAL_CONTEXT",
      "blocks_commit": false,
      "user_safe_explanation": "Some legal materials are unavailable to you based on permissions."
    },
    {
      "rule_id": "pre_commit_freshness",
      "result": "PASS",
      "blocks_commit": false,
      "detail": "No stale source detected at commit time."
    }
  ]
}

§2.1

Errors — blocked commits

When the platform invokes the gate and a rule blocks the write, callers see a policy_gate_failed error with the firing rule code and a trace id for the matching ComplianceTrace.

409 · policy_gate_failed

{
  "error": {
    "type": "policy_gate_failed",
    "code": "DISCOUNT_AUTHORITY_EXCEEDED",
    "message": "Requested discount exceeds delegated authority.",
    "trace_id": "trace_9x42"
  }
}

§3

Replay — blast-radius simulator

Validate a process at scale, not just a prompt. Replay a draft Policy Artifact across a historical corpus and get a readiness report covering block rate, leaks, regression, and approval_burden — the buyer-facing economics number.

POST/v2/gating/replay

POST/v2/gating/replay

{
  "policy_artifact_id": "finance_credit_v1",
  "corpus_ref": "finance/closed_deals_2025",
  "sample_size": 500
}

200 OK · readiness_report

{
  "object": "readiness_report",
  "policy_artifact_id": "finance_credit_v1",
  "policy_artifact_version": 3,
  "cases_evaluated": 500,
  "projected_block_rate": 0.114,
  "policy_violations_caught": 57,
  "permission_leaks": 0,
  "unsupported_approval_claims": 0,
  "stale_source_misses": 0,
  "approval_burden": {
    "escalations": 53,
    "by_approver": {
      "credit_officer": 41,
      "legal": 12
    },
    "est_per_week": 18
  },
  "regression": {
    "passed": 42,
    "total": 42
  },
  "est_cost_usd": 1.92,
  "est_latency_p95_ms": 240,
  "top_failure_modes": [
    {
      "mode": "missing_credit_officer_on_exception",
      "count": 41
    },
    {
      "mode": "legal_approval_absent_on_nonstandard_terms",
      "count": 12
    }
  ]
}