Governance overview

Availability

Cloud & Enterprise · Team plan and up (Policies & approvals: Enterprise)

Governance is the pillar that lets you put enforceable controls between your agents and consequential actions, and prove after the fact what was decided and why. It is part of the commercial edition (ee/governance); the endpoints below 404 in the Community core.

The governance pillar

Capability	What it does	Plan
Activity ledger	Append-only, hash-chained record of every decision and identity event.	Team+
Policy engine	RBAC/ABAC/ReBAC allow/deny rules, deny-wins.	Enterprise
Delegation & approvals	Spend limits, agent permissions, approval rules and pending approvals.	Spend limits Team+ · Permissions & approvals Enterprise
Compliance	SOC 2 / EU AI Act / NIST AI RMF reports and policy dry-run.	Team+

The authorize decision flow

POST /v1/authorize is the endpoint an agent calls before a consequential action. It returns a single decision — allow, deny, or needs_approval — and writes the outcome to the ledger. The evaluation runs in a fixed order and fails closed:

1. Agent explicit deny — if the agent has an explicit deny permission for the action → deny.
2. Spend limit — if the action would exceed the daily or monthly USD limit → deny. This step fails closed: if spend analytics are unavailable, the request is denied.
3. Policy evaluation — the policy engine is evaluated with deny-wins semantics; a matching deny → deny.
4. Approval rule — if an approval rule matches → needs_approval (or the request honors a prior recorded decision).
5. Otherwise → allow.

Every outcome, at every step, is recorded in the ledger.

Calling it from the SDK

Agents call authorize() before acting and log_action() / logAction() to record what they did. authorize() returns the decision your code branches on.

Python

from splyntra import authorize, log_action

decision = authorize(
    "payments.refund",
    agent_id="support_agent",
    context={"amount": 80},
)

if decision["decision"] == "allow":
    issue_refund()
    log_action("refund", actor="support_agent", resource="order:123", metadata={"amount": 80})
elif decision["decision"] == "needs_approval":
    await_human_approval()
else:  # deny
    reject()

TypeScript

import { authorize, logAction } from "@splyntra/sdk";

const d = await authorize("payments.refund", {
  agentId: "support_agent",
  context: { amount: 80 },
});

if (d.decision === "allow") {
  await issueRefund();
  await logAction("payments.refund", {
    actor: "support_agent",
    resource: "order:123",
    metadata: { amount: 80 },
  });
} else if (d.decision === "needs_approval") {
  await awaitHumanApproval();
} else {
  reject();
}

Next steps

• Activity ledger — the tamper-evident record.
• Policy engine — allow/deny rules with deny-wins.
• Delegation & approvals — spend limits and human approvals.
• Compliance — SOC 2 / EU AI Act / NIST reports.