Governed agent platform · live at govengine.ai
Governed AI agents,approved before they act.
Describe the workflow or start with a federal template. Review the graph, inspect every outward action, approve an immutable version, and run it manually, on a schedule, or from a verified external trigger.
- Weekly staleness checktrigger
- List SharePoint filesconnector
- Evaluate expiry datesconnector
- Summarise what lapsedllm
- Post to #records-opsconnector
300
agent templates
across 30 federal and operational categories
14
ready-to-run workflows
authored end to end; the rest are configurable
6
OAuth-connected apps
plus one connectionless HTTP connector
12
graph node types
one typed IR, shared by builder and executor
4
taint levels
static → input → connector output → LLM output
3
levels of delegation
shared model budget, cycle guard, hard cap
The problem
AI agents arrive as a promise.
Auditors do not accept promises.
A prompt is not a control surface
Reviewers are asked to sign off on an instruction, while what actually runs is assembled at run time and can change without notice.
Model-chosen destinations leak
When a model picks the channel, the recipient or the endpoint, data leaves with nobody having approved where it went.
Mutable agents cannot be defended
If the agent that ran last quarter no longer exists in that form, there is nothing to produce in an audit but assurances.
Generic observability misses the point
Traces show you failures. They do not show you who approved what, which destinations were acknowledged, or where policy stopped a run.
Two planes
The agent that runs is
the version a person approved.
- Design-time · humanDraft
It starts as a draft you can argue with
An LLM proposes the graph, or a catalog template supplies it. Either way it arrives as a readable flow — nodes, connections, branches, and every point where data leaves — not as a paragraph of instructions. Reviewers edit it by hand before anyone approves anything.
- The hingeApproved
Approval freezes a version
A person acknowledges each outward destination and approves. That writes an immutable version — immutable at the database, not just in application code. Editing an approved workflow creates a new draft; it never mutates what was signed off.
- Run-time · machineRunning
The executor walks the pinned graph
Runs pin a specific approved version, never "latest". A small deterministic executor walks it in topological order — no model decides control flow mid-run. Each step is snapshotted, append-only, with secrets redacted before anything is stored.
How it works
From a federal workflow
to an audited run.
01
Choose or describe
Pick a federal template, or say what you need in plain English and let the builder draft the graph.
02
Configure and bind
Fill a schema-driven form. Bind data sources to your connected apps — or to another agent’s output.
03
Review the egress
See every outward destination the graph can reach, including through maps and called subagents. Acknowledge each one.
04
Approve a version
Approval freezes an immutable version and snapshots the connection identities and scopes it was approved against.
05
Run and measure
Manually, on a governed schedule, or from a verified external trigger. Every run reports against the version that produced it.
Security & governance
Every way data can leave,
named before anything runs.
This is the review your compliance team already performs, done by the system and signed off by a person. GovEngine does the enumeration. A human does the deciding.
- Sends data outAcknowledged
Microsoft Teams — post message
#records-ops
- Sends data outAcknowledged
Microsoft Outlook — send email
records-ops@agency.example.gov
- Sends data outAcknowledged
SharePoint — upload file
/Compliance/Staleness Reports
The approval control stays locked until every destination is acknowledged. Destinations are static or human-configured — the graph will not validate if one is derived from model output.
How a value is tracked
- static
- input
- connector-output
- llm-output
The rightmost level is the one that cannot reach an egress-critical field.
Every outward action, enumerated before approval
Approval-time review walks the whole graph and lists each place data can leave — a channel, a recipient, an upload destination, an HTTP endpoint — including the ones reached inside a map or through a called subagent, whose pinned child graph is expanded rather than hidden behind one generic row. Every side-effecting destination is acknowledged individually before the approval control unlocks.
A model cannot invent a destination
A four-level lattice records where every value came from. When a value derived from model output is used in an egress-critical field — a URL, a channel, a recipient, an upload path — validation rejects the graph. That closes the class of attack where a model is talked into sending data somewhere new.
Human-in-the-loop, decided up front
Catalog workflows marked for human review block side-effecting connector operations unless the run was started with Approve & run. The reviewer decides before anything moves, not after — and a blocked run is recorded as a policy stop, reported separately from a software failure.
Secret-shaped fields are scrubbed from every record
Snapshots are scrubbed before they are stored or shown, and anything over 256 KiB is reduced to a preview plus its original size and SHA-256. Redaction is field-name based — it is a discipline, not a guarantee that no secret can ever be logged.
The federal catalog
Start with a federal workflow,
not a blank prompt.
- Solicitation Drafting Agent
- SSP Drafting Agent
- Phishing Analysis Agent
- Document Summarization Agent
- Regulatory Comment Analysis Agent
- Federal Register Monitoring Agent
- Chat Platform Compliance Monitoring Agent
- Agency Mention News Monitoring Agent
- Regulatory & Legislative Tracking Agent
- Cyber Threat Landscape News Agent
- Policy Exception/Waiver Expiration Agent
- Vendor Compliance Document Expiration Agent
- Continuous ATO Status Agent
- Document Lifecycle Staleness Agent
Authored — 14 templates
Complete workflow logic: real graph nodes and real integrations, authored end to end. These are the ones in the list above, and they carry a dedicated Ready to run view in the catalog.
Generic — the remaining 286
Configurable agents that reason over the values you supply and return findings or post a configured alert. They do not automatically read every data source named in their catalog metadata. We would rather you learn that here than in a pilot.
Every template configures through a schema-driven form — text, numbers, enums, sliders, multi-selects, alert definitions and resource pickers — then binds to your connected applications or to another agent’s output.
The platform
Everything an agent needs,
inside the same governance.
Plain-English builder
Describe the outcome. The builder restates it, asks up to two clarifying questions, then drafts a complete graph through your selected model route. A structural validator proves it is acyclic, fully wired and free of dangling references before anyone can approve it — and an invalid draft gets one automatic repair attempt using the exact validator error.
Governed connectors
Six OAuth applications plus a connectionless HTTP connector, every call through one chokepoint: parameter validation, decrypt, execute, refresh-once on a 401, output-schema validation.
Triggers and channels
Governed schedules with a cron interval floor and overlap prevention, HMAC-signed webhooks, signature-verified Slack events, and provider-verified inbound email. Every route lands in the same approved-version run service as a manual run.
Subagents and artifacts
An agent can call a specific immutable version of another agent, inside a shared model-call budget with a depth cap and a cycle guard. Durable artifacts download workspace-scoped, with attachment disposition and a sandboxed CSP.
Dry-run before approval
Run a draft with side-effecting connector operations replaced by deterministic dry-run outputs: nothing is written, sent, posted or uploaded. Read-only steps and model calls still hit the real service, so what you inspect is real data and real model behaviour. Dry-run steps are labelled and excluded from node metrics.
Operational evidence
Success rate and p50/p95 latency over root runs only, so a subagent call does not inflate the numbers, with dry-run steps kept out of node metrics. Policy stops are reported separately from software failures, cost is priced against the model actually served, and unknown pricing shows as unknown rather than a misleading $0.00.
Connects to the systems you already run
Google Drive
list · read · upload
SharePoint
browse · read · upload
Gmail
send only
Outlook
send via Graph
Slack
post · browse · events
Microsoft Teams
post · browse
HTTP
SSRF-guarded · no connection
Connectors are interchangeable by capability, and the swap happens at build time so the stored graph always names the application it will really call: Drive ⇄ SharePoint for documents, Gmail ⇄ Outlook for email, Slack ⇄ Teams for channel delivery.
Built for procurement review
The boring guarantees,
in writing.
- SSO
- Optional Google and Microsoft Entra ID sign-in alongside Argon2id passwords. Every new account is pending until an administrator approves it, and the last approved admin cannot be removed.
- AES-256-GCM
- Connector credentials encrypted at rest, bound by additional authenticated data to both the workspace and the connection row. They decrypt at one boundary and never enter graph state or a run step.
- Immutable
- Approved versions and run steps cannot be updated — enforced by database REVOKE, not by application code. The app and worker connect as a non-owner role so the rule actually bites.
- Fail-closed
- Concurrency, runs per minute, daily run and model-call budgets, map fan-out and a cron interval floor all reject before the work happens, and a missing credential stops a run before it is queued. The daily spend cap is the honest exception: token cost is unknown until the response, so it trips on the call that crosses the line and blocks every call after it that day.
- Self-hosted
- TLS terminated at Caddy in front of a private localhost service, separate web and worker units, authenticated loopback-only Postgres and Redis, and forward-only tracked migrations.
What this page does not claim: no certification, authorization or federal hosting region is asserted. Redaction is field-name based rather than full secret-value detection. Model outputs still vary — it is the control flow that is pinned, not the prose.