Core Capability
Govern
Every agent gets a purpose, an identity, a scope, and a leash.
Overview
Govern is where detection meets enforcement. Every agent in the SinzAI registry receives five governance primitives: a registered purpose, a scoped access policy, a cryptographic identity with short-lived credentials, human-in-the-loop gates on external side effects, and a kill switch. These primitives are enforced at runtime — not at build time, not at code review time, but in the instant before every action.
Five Governance Primitives
🎯Registered Purpose
Every agent must declare its purpose — a natural-language statement of what it is designed to do. This purpose is the anchor for all behavioral drift detection. When an agent's actions deviate from its declared purpose, the Memory Governance module flags it for review.
🔐Scoped Access
Access is granted at the data-store level, with read/write/admin distinctions. Scopes are defined as allow-lists, not deny-lists: an agent can only access data stores explicitly listed in its scope. Cross-region access requires explicit opt-in with justification.
🪪Cryptographic Identity
Every agent receives a decentralized identifier (DID) anchored to a cryptographic key pair. Credentials are short-lived — configurable TTL from 1 hour to 7 days — and automatically rotated. This satisfies CISA's requirement for cryptographically anchored agent identities with short-lived credentials.
✋HITL Gates
Human-in-the-loop gates intercept external side effects: sending emails, writing to production APIs, executing financial transactions above $10,000, deleting data. Gates are configurable per agent, per action type, and per data sensitivity level.
🛑Kill Switch
A single action that instantly revokes all agent credentials, halts all in-flight operations, and triggers the failure protocol. Deployable from the console, CLI, API, or a physical webhook endpoint. Sub-second propagation.
HITL Gate Configuration
Gates are configured as policy rules targeting specific action types. Each rule defines the condition, the approval channel, and the timeout behavior:
| Action Type | Condition | Approval Channel | Timeout |
|---|---|---|---|
| Email send | External recipients | Slack / Teams | 15 min → auto-deny |
| API write | Production environment | Slack / Webhook | 5 min → auto-deny |
| Financial tx | Amount > $10,000 | Email (dual approval) | 60 min → auto-deny |
| Data deletion | Any PII / PHI / PCI | Slack + Email | 10 min → auto-deny |
| Model fine-tune | On customer data | Email (security team) | 24 hr → auto-deny |
Credential Lifecycle
- 1Agent is registered → cryptographic key pair generated, DID issued
- 2Short-lived credential issued with configurable TTL (default: 24 hours)
- 3Credential automatically rotates at 80% of TTL — no downtime
- 4On policy violation or trust score drop, credential is revoked immediately
- 5Kill switch revokes all credentials for all agents simultaneously