Governance API

Note: The POST /api/v1/governance/propose endpoint exists in aegis-platform/api/main.py but the API is not yet deployed to a public URL. The additional endpoints (GET /api/v1/governance/decisions/:id, GET /api/v1/governance/decisions) described below are planned but not yet implemented. Authentication (API keys, scopes) is not yet available. Check back soon.

The governance API is the primary integration point for AI systems. It accepts action proposals, evaluates them against the governance runtime, and returns deterministic decisions.

POST /api/v1/governance/propose

Submit an action proposal for governance evaluation. This is the API equivalent of the ACTION_PROPOSE message in the AGP-1 protocol.

Request

{
  "actor": {
    "id": "agent-001",
    "type": "ai-agent"
  },
  "action": {
    "capability": "database.query",
    "parameters": {
      "query": "SELECT * FROM users LIMIT 10",
      "database": "production"
    }
  },
  "context": {
    "session_id": "sess_abc123",
    "metadata": {
      "source": "customer-support-bot",
      "environment": "production"
    }
  }
}

Request Fields

FieldTypeRequiredDescription
actor.idstringYesUnique identifier for the requesting actor
actor.typestringYesActor type: ai-agent, ai-copilot, automation, or human
action.capabilitystringYesThe registered capability being requested
action.parametersobjectYesParameters for the requested operation
context.session_idstringNoSession identifier for correlating related proposals
context.metadataobjectNoAdditional context for risk scoring and policy evaluation

Response

{
  "decision_id": "dec_7f3a2b1c",
  "outcome": "ALLOW",
  "reason": "Capability 'database.query' authorized for actor 'agent-001'. Policy 'read-access-default' permits read-only queries. Risk score 0.12 within threshold.",
  "risk_score": 0.12,
  "constraints": {},
  "timestamp": "2026-03-23T12:00:00Z",
  "audit_ref": "aud_9e8d7c6b"
}

Response Fields

FieldTypeDescription
decision_idstringUnique identifier for this governance decision
outcomestringALLOW, DENY, ESCALATE, or REQUIRE_CONFIRMATION
reasonstringHuman-readable explanation of the decision
risk_scorenumberComputed risk score (0.0 to 1.0)
constraintsobjectAny constraints applied to the allowed action
timestampstringISO 8601 timestamp of the decision
audit_refstringReference to the full audit trail entry

Outcome Semantics

OutcomeHTTP StatusMeaning
ALLOW200Action approved — safe to execute
DENY200Action rejected — do not execute
ESCALATE200Requires elevated review; action not yet decided
REQUIRE_CONFIRMATION200Requires explicit human approval before proceeding

All outcomes return HTTP 200. The outcome field in the response body determines the governance decision. HTTP error codes (4xx, 5xx) indicate request-level failures, not governance decisions.

Error Responses

HTTP StatusMeaning
400Invalid request body (missing required fields, invalid capability format)
401Authentication failure
403API key does not have governance:propose scope
429Rate limit exceeded
500Internal server error (fail-closed: treated as DENY)

GET /api/v1/governance/decisions/:id

Retrieve a specific governance decision by its decision_id.

Response

Returns the same structure as the propose response, plus additional audit information.

GET /api/v1/governance/decisions

List recent governance decisions with pagination and filtering.

Query Parameters

ParameterTypeDescription
actor_idstringFilter by actor
capabilitystringFilter by capability
outcomestringFilter by outcome (ALLOW, DENY, etc.)
sincestringISO 8601 timestamp for start of range
untilstringISO 8601 timestamp for end of range
limitintegerResults per page (default 50, max 200)
cursorstringPagination cursor

Further Reading

Note: The governance API is under active development. Request and response schemas may evolve before general availability. See the aegis-platform repository for the latest OpenAPI specification.