Beta module namespace
governance
Beta routes may change with notice and are NOT covered by the 24-month stable window of the core contract.
Every module route is enumerated with method, path, auth and required permission; request/response schemas are not published for the beta surface.
90 operations
| Method | Path | Required permission | Authentication | Summary |
|---|---|---|---|---|
| get | /v1/m/governance/agent-risk-profiles | governance:agent-risk:read | Bearer token | Lists profiles, optionally filtered by tier. |
| post | /v1/m/governance/agent-risk-profiles/classify | governance:agent-risk:write | Bearer token | Computes (or recomputes) the suggested risk tier for an agent from observed signals. |
| get | /v1/m/governance/agent-risk-profiles/{id} | governance:agent-risk:read | Bearer token | Returns one profile. |
| post | /v1/m/governance/agent-risk-profiles/{id}/review | governance:agent-risk:admin | Bearer token | Marks a classification as human-reviewed. |
| put | /v1/m/governance/agent-risk-profiles/{id}/tier | governance:agent-risk:admin | Bearer token | Sets the operator's authoritative tier for an agent. |
| post | /v1/m/governance/agentcore-export/apply | governance:agentcore-export:admin | Bearer token | governance module route (requires governance:agentcore-export:admin) |
| post | /v1/m/governance/agentcore-export/plan | governance:agentcore-export:admin | Bearer token | governance module route (requires governance:agentcore-export:admin) |
| post | /v1/m/governance/agents | governance:nhi:admin | Bearer token | Creates a lifecycle row with kind=agent and mandatory sponsor. |
| post | /v1/m/governance/agents/{agentID}/identity | governance:identity:admin | Bearer token | Binds an agent to its NHI identity (Agent.IdentityID). |
| delete | /v1/m/governance/agents/{agentID}/identity | governance:identity:admin | Bearer token | Clears an agent's identity binding. |
| get | /v1/m/governance/approvals | governance:approval:read | Bearer token | Lists requests, optionally filtered by status/action. |
| post | /v1/m/governance/approvals | governance:approval:write | Bearer token | Opens an approval request. |
| post | /v1/m/governance/approvals/sweep | governance:approval:admin | Bearer token | Materializes expiry and escalation for the tenant's pending approvals. |
| get | /v1/m/governance/approvals/{id} | governance:approval:read | Bearer token | Returns one request with its effective status. |
| post | /v1/m/governance/approvals/{id}/cancel | governance:approval:write | Bearer token | Cancels a pending request. |
| post | /v1/m/governance/approvals/{id}/consume | governance:approval:write | Bearer token | governance module route (requires governance:approval:write) |
| get | /v1/m/governance/approvals/{id}/decisions | governance:approval:read | Bearer token | Returns the immutable decision trail for a request — the action→human traceability view. |
| post | /v1/m/governance/approvals/{id}/decisions | governance:approval:admin | Bearer token | Records one human decision. |
| get | /v1/m/governance/bindings | governance:idposture:read | Bearer token | Lists agent↔identity bindings, flagging identities shared across agents. |
| get | /v1/m/governance/breakglass | governance:breakglass:read | Bearer token | Lists grants, optionally filtered by stored status; a grant past its expiry reads as "expired" in its DTO regardless. |
| post | /v1/m/governance/breakglass | governance:breakglass:admin | Bearer token | Opens an emergency window. |
| post | /v1/m/governance/breakglass/consume | governance:breakglass:write | Bearer token | governance module route (requires governance:breakglass:write) |
| get | /v1/m/governance/breakglass/{id} | governance:breakglass:read | Bearer token | Returns one grant with its effective status. |
| post | /v1/m/governance/breakglass/{id}/review | governance:breakglass:admin | Bearer token | Records the FORCED post-review of a terminal grant. |
| post | /v1/m/governance/breakglass/{id}/revoke | governance:breakglass:admin | Bearer token | Closes an active grant early. |
| get | /v1/m/governance/breakglass/{id}/uses | governance:breakglass:read | Bearer token | Returns the immutable use trail for a grant — what actually proceeded under the emergency window (the post-review's evidence). |
| get | /v1/m/governance/emerging-identity-standards | governance:identity:read | Bearer token | Surfaces the design-toward registry read-only, with an explicit disclaimer that it is tracked, not implemented (IDN-12). |
| get | /v1/m/governance/groups | governance:identity:read | Bearer token | Lists the reconciled collections (groups/roles/policies). |
| get | /v1/m/governance/groups/{ref}/members | governance:identity:read | Bearer token | Lists a group's members. |
| get | /v1/m/governance/guardian/actions | governance:guardian:read | Bearer token | Lists the containment trail, optionally by status. |
| get | /v1/m/governance/guardian/rules | governance:guardian:read | Bearer token | governance module route (requires governance:guardian:read) |
| post | /v1/m/governance/guardian/rules | governance:guardian:admin | Bearer token | Authors a containment rule. |
| put | /v1/m/governance/guardian/rules/{id} | governance:guardian:admin | Bearer token | Updates a rule's mutable fields (enable/disable, matching, action, mode, note). |
| delete | /v1/m/governance/guardian/rules/{id} | governance:guardian:admin | Bearer token | Deletes a rule only after terminalizing every queued action that could otherwise execute from its denormalized action row. |
| get | /v1/m/governance/identities | governance:identity:read | Bearer token | Lists the reconciled identity roster. |
| get | /v1/m/governance/killswitch | governance:killswitch:read | Bearer token | Lists stop rows, optionally filtered by stored status — the persisted, visible stop state (who, when, scope, reason). |
| post | /v1/m/governance/killswitch | governance:killswitch:admin | Bearer token | governance module route (requires governance:killswitch:admin) |
| get | /v1/m/governance/killswitch/state | governance:killswitch:read | Bearer token | Returns the live stop posture for the tenant. |
| get | /v1/m/governance/killswitch/{id} | governance:killswitch:read | Bearer token | Returns one stop row. |
| get | /v1/m/governance/killswitch/{id}/evidence | governance:killswitch:admin | Bearer token | Builds and returns the incident evidence pack. |
| post | /v1/m/governance/killswitch/{id}/reenable | governance:killswitch:admin | Bearer token | Lifts a stop — NEVER unilaterally. |
| post | /v1/m/governance/killswitch/{id}/review | governance:killswitch:admin | Bearer token | Records the FORCED post-review of a re-enabled stop: a real human DIFFERENT from the engager, the re-enable requester and the re-enabler (separation of duties — nobody signs off their own incident), once, note mandatory. |
| get | /v1/m/governance/nhi | governance:nhi:read | Bearer token | Lists the NHI lifecycle rows, optionally filtered by enforcement state or offboard state. |
| get | /v1/m/governance/nhi/posture | governance:nhi:read | Bearer token | Aggregates the lifecycle posture. |
| post | /v1/m/governance/nhi/sweep | governance:nhi:admin | Bearer token | Materializes staleness/escalation, orphan and unsponsored state for the tenant's NHI lifecycle rows, and ensures a row exists for every roster NHI. |
| get | /v1/m/governance/nhi/{ref} | governance:nhi:read | Bearer token | Returns one NHI lifecycle row by identity_ref. |
| get | /v1/m/governance/nhi/{ref}/events | governance:nhi:read | Bearer token | Lists the append-only lifecycle event trail for one NHI. |
| post | /v1/m/governance/nhi/{ref}/offboard | governance:nhi:admin | Bearer token | Runs the reversible soft-delete step of a governed offboarding: it blocks the NHI in-product (enforcement=blocked, the cascade that denies every bound agent at the PEP), opens an audited recovery window, and best-effort disables the credential at the source. |
| post | /v1/m/governance/nhi/{ref}/offboard/finalize | governance:nhi:admin | Bearer token | governance module route (requires governance:nhi:admin) |
| put | /v1/m/governance/nhi/{ref}/ownership | governance:nhi:write | Bearer token | Assigns owner/sponsor. |
| put | /v1/m/governance/nhi/{ref}/policy | governance:nhi:write | Bearer token | Authors the per-NHI rotation policy. |
| post | /v1/m/governance/nhi/{ref}/restore | governance:nhi:admin | Bearer token | Reverses a soft-delete within the recovery window: best-effort re-enable at the source, clear the in-product block. |
| post | /v1/m/governance/nhi/{ref}/rotate | governance:nhi:admin | Bearer token | Orchestrates a governed rotation: it opens the CRITICAL approval (two-person floor via the engine), and only on an approved/break-glass decision invokes the wired actuator, returning the minted credential ONCE. |
| get | /v1/m/governance/pdp/active | governance:policy:read | Bearer token | Reports what the STORE currently selects for an engine, and — for cedar — discloses the other surfaces that are unioned into the enforced policy. |
| post | /v1/m/governance/pdp/dry-run | governance:policy:read | Bearer token | governance module route (requires governance:policy:read) |
| post | /v1/m/governance/pdp/explain | governance:policy:read | Bearer token | Evaluates an example request against a CANDIDATE source and returns the three-valued decision chain: a matched permit GRANTS within scope, a matched forbid RESTRICTS, neither abstains (the RBAC decision stands). |
| post | /v1/m/governance/pdp/publish | governance:policy:admin | Bearer token | Persists a versioned Cedar/OPA policy and, for Cedar, ACTIVATES it on the live hot path (recomposes the per-tenant overlay). |
| post | /v1/m/governance/pdp/rollback | governance:policy:admin | Bearer token | Re-activates an existing immutable revision by appending an activation record. |
| get | /v1/m/governance/pdp/tests | governance:policy:read | Bearer token | governance module route (requires governance:policy:read) |
| post | /v1/m/governance/pdp/validate | governance:policy:read | Bearer token | Compiles a source WITHOUT loading it into the live evaluator. |
| get | /v1/m/governance/pdp/versions | governance:policy:read | Bearer token | Lists the cedar + opa authored revisions (the shared revision store, kinds cedar/opa). |
| get | /v1/m/governance/pdp/versions/{revision} | governance:policy:read | Bearer token | governance module route (requires governance:policy:read) |
| get | /v1/m/governance/policies | governance:policy:read | Bearer token | Lists governance policies, optionally filtered by kind/enabled. |
| post | /v1/m/governance/policies | governance:policy:admin | Bearer token | Authors a governance policy. |
| get | /v1/m/governance/policies/{id} | governance:policy:read | Bearer token | Returns one governance policy. |
| put | /v1/m/governance/policies/{id} | governance:policy:admin | Bearer token | Updates a governance policy in place (kind is immutable). |
| delete | /v1/m/governance/policies/{id} | governance:policy:admin | Bearer token | Deletes a governance policy. |
| get | /v1/m/governance/rbac/catalog | governance:rbac:read | Bearer token | governance module route (requires governance:rbac:read) |
| get | /v1/m/governance/rbac/delegation-authority | governance:rbac:read | Bearer token | governance module route (requires governance:rbac:read) |
| get | /v1/m/governance/rbac/grants | governance:rbac:read | Bearer token | governance module route (requires governance:rbac:read) |
| post | /v1/m/governance/rbac/grants | governance:rbac:admin | Bearer token | governance module route (requires governance:rbac:admin) |
| get | /v1/m/governance/rbac/grants/{id} | governance:rbac:read | Bearer token | governance module route (requires governance:rbac:read) |
| delete | /v1/m/governance/rbac/grants/{id} | governance:rbac:admin | Bearer token | governance module route (requires governance:rbac:admin) |
| get | /v1/m/governance/rbac/permission-groups | governance:rbac:read | Bearer token | governance module route (requires governance:rbac:read) |
| post | /v1/m/governance/rbac/permission-groups | governance:rbac:admin | Bearer token | governance module route (requires governance:rbac:admin) |
| get | /v1/m/governance/rbac/permission-groups/{name} | governance:rbac:read | Bearer token | governance module route (requires governance:rbac:read) |
| put | /v1/m/governance/rbac/permission-groups/{name} | governance:rbac:admin | Bearer token | governance module route (requires governance:rbac:admin) |
| delete | /v1/m/governance/rbac/permission-groups/{name} | governance:rbac:admin | Bearer token | governance module route (requires governance:rbac:admin) |
| get | /v1/m/governance/rbac/roles | governance:rbac:read | Bearer token | governance module route (requires governance:rbac:read) |
| post | /v1/m/governance/rbac/roles | governance:rbac:admin | Bearer token | governance module route (requires governance:rbac:admin) |
| get | /v1/m/governance/rbac/roles/{name} | governance:rbac:read | Bearer token | governance module route (requires governance:rbac:read) |
| put | /v1/m/governance/rbac/roles/{name} | governance:rbac:admin | Bearer token | governance module route (requires governance:rbac:admin) |
| delete | /v1/m/governance/rbac/roles/{name} | governance:rbac:admin | Bearer token | governance module route (requires governance:rbac:admin) |
| post | /v1/m/governance/roster/sync | governance:identity:admin | Bearer token | Triggers a roster reconciliation for the resolved tenant from the identity providers the composition root wired (UseRosterProviders). |
| get | /v1/m/governance/routine-policies | governance:routine:read | Bearer token | Lists routine policies, optionally filtered by scope_kind or enabled. |
| post | /v1/m/governance/routine-policies | governance:routine:admin | Bearer token | Creates a routine policy. |
| get | /v1/m/governance/routine-policies/posture | governance:routine:read | Bearer token | Returns the routine governance posture: EVERY policy in the tenant (enabled or not, with the two counters splitting them), plus the COMPOSED decision for one resolution scope. |
| get | /v1/m/governance/routine-policies/{id} | governance:routine:read | Bearer token | Returns one routine policy by ID. |
| put | /v1/m/governance/routine-policies/{id} | governance:routine:admin | Bearer token | Updates a routine policy's mutable fields. |
| delete | /v1/m/governance/routine-policies/{id} | governance:routine:admin | Bearer token | Deletes a routine policy. |