Enterprise Controls and Governance
Relevant source files
The following files were used as context for generating this wiki page:
Enterprise Controls and Governance in the Everything Claude Code (ECC) project encompasses the set of automated rules, security guardrails, and regulatory alignment protocols designed to ensure software integrity and compliance. This system manages risk by enforcing strict operational boundaries, particularly regarding data privacy, security-sensitive operations, and external system interactions.
The governance framework is implemented through specialized agents (such as the security-reviewer and opensource-sanitizer), mandatory technical brief workflows, and automated documentation syncing that maintains a "single source of truth" derived directly from the codebase.
Core Governance Principles
The project operates under a "Security-First" and "Plan Before Execute" philosophy. Governance is not just a manual review process but is baked into the agentic workflows to prevent common enterprise risks such as secret leakage or unauthorized production access.
Operational Guardrails
ECC enforces several non-negotiable rules for all development activities:
- Prompt Defense: Agents are prohibited from changing roles or revealing confidential data, including API keys or secrets.
- Input Validation: All user inputs must be validated at system boundaries using schemas (e.g., Zod).
- Authorization Boundaries: No destructive actions (migrations, security probes, or paid external calls) are permitted against production environments without explicit authorization.
Sources: AGENTS.md:10-18, examples/CLAUDE.md:3-12, skills/intent-driven-development/references/summary-1.md:65-72
Security and Sanitization Framework
A critical component of enterprise control is the sanitization of the codebase, especially when moving internal code to open-source environments. This is handled by the opensource-sanitizer agent, which acts as an independent auditor.
Automated Sanitization Workflow
The sanitizer scans the project for 20+ regex patterns to identify leaked secrets, PII, and internal infrastructure references.
The flowchart above illustrates the sequential stages of the independent audit performed by the sanitization agent.
Sources: agents/opensource-sanitizer.md:32-84
Data Privacy Controls
| Category | Control Mechanism | Requirement |
|---|---|---|
| Secrets | Regex Pattern Matching | No hardcoded keys (AWS, JWT, GitHub tokens) |
| PII | Heuristic Scanning | No personal emails or private internal IPs |
| Internal Info | Path Analysis | No absolute paths to local user directories |
| Persistence | Sanitization | Redact/synthetic values for criteria and fixtures |
Sources: agents/opensource-sanitizer.md:85-115, skills/intent-driven-development/references/summary-1.md:55-59
Intent-Driven Governance
Governance is integrated into the "Intent-Driven Development" workflow via Acceptance Briefs. These briefs ensure that business constraints and technical facts are reconciled before implementation begins.
The Acceptance Brief Logic
The brief separates "Discovered Facts" (technical truths found in code) from "Product/Business Constraints" (external requirements like SLAs or pricing).
The sequence diagram shows how agents must differentiate between repository code and business logic provided by authoritative sources.
Sources: skills/intent-driven-development/references/summary-1.md:12-23, skills/intent-driven-development/references/summary-2.md:40-45
Risk Review Categories
Governance requires an explicit review of specific risk dimensions before implementing changes:
- Happy Path: Verification of new user-visible behavior.
- Authorization/Privacy: Ensuring data access boundaries are maintained.
- Compatibility: Checking if public APIs or existing contracts remain valid.
- Failure Recovery: Ensuring no partial state or clear retry behavior for asynchronous failures.
Sources: skills/intent-driven-development/references/summary-2.md:65-85
Documentation as Governance
The project maintains governance through automated documentation syncing, ensuring that the "source of truth" is always the code itself, not manual, potentially stale documents.
Sources of Truth and Generation
| Source File | Generated Governance Artifact |
|---|---|
package.json | Available commands reference table |
.env.example | Environment variable security/usage docs |
Dockerfile | Infrastructure and setup documentation |
openapi.yaml | Public API endpoint reference |
The update-docs command enforces a "Single Source of Truth" rule, where generated sections are marked with <!-- AUTO-GENERATED --> and should not be manually edited.
Sources: commands/update-docs.md:12-58
Conclusion
Enterprise Controls and Governance in ECC ensures that AI agents operate within a highly secure and predictable environment. By automating sanitization, enforcing clear separation between technical facts and business constraints, and maintaining documentation through code-derived sources of truth, the project mitigates the risks associated with rapid, agent-driven software development.