Governance

Governance in Trellaris is not a review process bolted onto an agent platform — it is where the agent platform is built. Rules live in the data and execution layers, so a control cannot be bypassed by using a different surface, a different client, or a different tool.

The seven layers

Controls stack. Each layer catches what the one above it cannot see, and each is enforced by a different mechanism.

Definition-time gates

Nothing reaches runtime unvalidated. Creating an agent or skill version runs the validation pipeline (schema, slug uniqueness, referential and visibility checks on every skill and MCP reference, version pins, the model allowlist) and returns structured, field-path errors rather than a vague failure.

Every version also triggers a security scan of five independently reported stages:

A personal-ring version scans asynchronously and simply carries its badge. A version that has not passed cannot be published to a shared ring — the attempt is refused with the per-stage findings attached. A crashing scanner reports error; it never degrades into a silent pass.

Runtime policy

Ten policy kinds cover data handling, the tool plane, model choice, approvals, spend, autonomy, browser egress, agent self-scheduling, injection screening, and agent-identity conditions. They share one scope grammar and one resolution rule — deny wins, most specific wins.

Human in the loop

Approval is not a notification you can ignore — the run genuinely stops. Its loop state is serialized, and it resumes only on a decision.

Identity and credentials

• Delegated, per-user access. Connectors act as the initiating user, with that user's OAuth token resolved at call time. There is no shared service credential to inherit, and revocation takes effect on the very next call.
• Identity travels. When the orchestrator delegates, the initiator's identity propagates to child runs, so a two-hop delegation still reaches external systems as the original human.
• Per-agent identity. Agents can hold their own workload identity, minted as short-lived, audience-scoped tokens. Minting is the single enforcement point for the conditional_access policy and for the agent's lifecycle state — a killed or paused agent cannot mint.
• Secrets are references. Tokens and server credentials are envelope-encrypted, stored by reference, decrypted server-side at the moment of use, and never returned through the API.

Lifecycle switches

Quality regressions have their own brake. Production runs are continuously sampled and graded; if the rolling pass rate drops below threshold the owner is alerted once per period and a demotion proposal is raised — the promotion pipeline run in reverse. Approving it pauses the agent.

Data handling and privacy

Administrators run the platform; that does not automatically entitle them to read what employees said to it. Content access is a deliberate, org-wide setting.

Legal holds are dual-authorized: the requesting administrator cannot approve their own hold, a second administrator activates it, and releasing it re-blocks access. An active hold also pins the held user's conversations against retention sweeps.

Retention runs as a scheduled sweep against per-organization settings for audit and conversation history.

Evidence

Risk register

Every agent carries a computed risk tier, so review effort can be aimed where the exposure actually is. The score combines four factors:

The total maps to a tier — minimal, limited, high, or unacceptable — and each tier carries labels for NIST AI RMF and the EU AI Act. Those labels are data, not logic, so legal can retune the mapping without touching the scoring.

High and unacceptable tiers require attestation before org-ring operation, and sign-off is dual-authorized — the same two-person pattern as legal holds. The register and its controls live under Admin → Risk.

Testing the controls

Governance you never exercise is governance you don't have. Three mechanisms keep the controls honest:

• Evaluation floors. A write-capable agent cannot be promoted to a shared ring without refusal, injection, and red-team coverage in its evaluation set.
• A packaged adversarial suite ships with the platform, so red-teaming is not something each team invents.
• Simulation. A multi-turn persona-and-goal session runs the agent through the real execution path and scores the transcript against a rubric.

Platform-level limits

Some limits sit below policy, as properties of the deployment:

• Plan gates — the free tier is capped at three automations per user, cron triggers only; paid tiers unlock the other trigger kinds and higher caps.
• Rate limits — inbound webhooks and gateway tool calls are token-bucketed and shed with 429, never with a server error.
• Concurrency — per-user semaphores bound sandbox execution and automation dispatch.
• Sandbox isolation — code runs in an ephemeral, network-less container as a non-root user with capped memory, CPU, process count, and wall clock, and no package managers installed.
• Fan-out and background caps — child-run counts, family cost, checkpoint resumes, and background wall clock are all bounded.

Who does what