Governance Engine & Policies

Relevant source files

The following files were used as context for generating this wiki page:

• services/runtime/governance/policy_engine.py
• _archive/ai-farbrik/ai-farbrik/packages/governance_kernel/init.py
• services/api/agents/brain_agents/senior-quality-auditor.md
• services/api/agents/brain_agents/order-workflow-specialist.md
• services/api/agents/brain_agents/legal-expert.md
• ARCHITECTURE.md
• SECURITY.md

The Governance Engine serves as the central authority for enforcing rules, managing risk, and ensuring compliance across the NeXifyAI platform. It operates as an independent layer that gates all system operations, including agent executions, code deployments, and runtime behaviors. By integrating capability-based access control with deterministic policy enforcement, the engine maintains platform integrity and aligns autonomous actions with the founder's mandates.

Sources: ARCHITECTURE.md, _archive/ai-farbrik/ai-farbrik/packages/governance_kernel/init.py:1-12

Governance Architecture

The platform follows a "Governance-first" principle where all runtime operations pass through a Governance Bootstrap process before execution. This architecture ensures that no action occurs without validation against the central policy registry.

Operational Flow

The engine executes a sequential validation pipeline for every operation:

1. Capability Check: Verifies if the actor possesses the required scoped tokens.
2. Risk Assessment: Classifies the operation (LOW to CRITICAL) and enforces deterministic policies.
3. Blast Radius Check: Evaluates the potential impact on downstream systems.
4. Final Decision: Grants approval, denies the request, or escalates for human review.

Sources: ARCHITECTURE.md:4, 49-54, _archive/ai-farbrik/ai-farbrik/packages/governance_kernel/init.py:60-67

The diagram above illustrates the deterministic pipeline executed by the Governance Kernel to gate platform operations.
Sources: _archive/ai-farbrik/ai-farbrik/packages/governance_kernel/init.py:141-168

Policy Engine Definitions

The Policy Engine maintains the central rulebook for governed autonomy. It categorizes rules into specific domains to manage different aspects of the platform lifecycle.

Core Policy Groups

Policy Group	Purpose	Primary Rules
Merge Policy	Controls code integration	No direct pushes to main; PRs must pass Merge Governor; Risk score < 8 for auto-merge.
Deployment Policy	Controls production releases	Mandatory build pass; Rollback snapshot creation; Post-deploy health checks.
Agent Policy	Governs AI agent actions	Agents must report to Brain; No direct pushes to main; Max 12 orchestrated core systems.
Runtime Policy	Enforces code standards	VITE environment variables only; Optional chaining required; Lazy-loading for routes.

Sources: services/runtime/governance/policy_engine.py:6-52

Quality Gates & Auditing

The senior-quality-auditor enforces seven mandatory quality gates that any system, deployment, or agent must pass before reaching production.

The Seven Gates

1. Documentation: Architecture specs, API docs, and SOP references must exist.
2. Testing: P0 systems require ≥80% unit test coverage and verified integration tests.
3. Security: Secrets must reside in vaults; no unnecessary open ports are permitted.
4. Architecture: Must fit the 12-System model and avoid duplication.
5. Performance: API latency must remain <200ms p95; Agent response must be <5s.
6. Workflow: Context must be enriched from the Brain; orders must exist in the workflow specialist.
7. Agent Quality: Profiles must exceed 4000 characters; Brain-First mandate must be active.

Sources: services/api/agents/brain_agents/senior-quality-auditor.md:20-64

Audit Scoring and Escalation

The Governance Engine calculates an average score across the seven gates:

• ≥0.85: Approved for production.
• 0.70 - 0.84: Conditional approval with required fixes.
• <0.50: Blocked; triggers P0 alert to CEO and halts the affected system.

Sources: services/api/agents/brain_agents/senior-quality-auditor.md:85-91

Risk and Capability Management

The Governance Kernel utilizes a tiered risk model and capability tokens to manage access to sensitive operations.

Risk Levels

• LOW/MEDIUM: Eligible for auto-approval if all policy checks pass.
• HIGH/CRITICAL: Mandatory human-in-the-loop approval regardless of automated check results.

Sources: _archive/ai-farbrik/ai-farbrik/packages/governance_kernel/init.py:31-36, 172-178

Default Capability Tokens

The engine registers standard tokens to gate external service interactions:

• github.write: Scoped to repo:nexifyai-dev/*.
• vercel.write: Scoped to project:frontend.
• supabase.write: Scoped to database:*.
• slack.write: Scoped to channel:#operations.

Sources: _archive/ai-farbrik/ai-farbrik/packages/governance_kernel/init.py:75-87

Legal and Compliance Governance

The legal-expert agent automates routine compliance audits and manages legal documentation currency.

Compliance Domains

• German Website Requirements: Enforces §5 TMG (Impressumspflicht) for business sites.
• GDPR / DSGVO: Validates privacy policies (Art. 13/14) and Data Processing Agreements (AVV).
• Cookie Policy: Ensures active opt-in consent mechanisms are implemented.
• Regulatory Monitoring: Tracks the EU AI Act and BGH rulings.

Sources: services/api/agents/brain_agents/legal-expert.md:27-52

The sequence diagram above demonstrates the interaction between an agent and the governance layer, highlighting the escalation path for high-risk operations.
Sources: _archive/ai-farbrik/ai-farbrik/packages/governance_kernel/init.py:141-180, SECURITY.md:32-37

Summary

The Governance Engine & Policies provide a deterministic framework that balances agent autonomy with enterprise-grade control. By enforcing mandatory quality gates, managing risk-based approvals, and maintaining a strict policy registry, the engine ensures that every platform operation is auditable, secure, and compliant with both legal standards (GDPR/TMG) and internal architectural mandates.