Governance harness

Immaculate

The policy and authorization harness for AI-assisted work that needs clean decisions, not hidden side effects.

Policy ALLOW / DENY / ESCALATE

Action intents are evaluated with subject, device, workspace, scope, command, and consequence context.

Authorization fresh binding

Sensitive actions need current principal, scope, transaction binding, revocation, and verifier-checkable records.

Resume PROCEED / REPLAN / HALT

Restart, retry, and reconnect flows route through RESUME_REVALIDATE before continuing.

Route governed

Why It Matters

Agentic systems fail when they silently continue with stale assumptions. Immaculate makes the assumption boundary explicit before work reaches files, commands, routes, or external services.

  • No static shared API key as identity.
  • No whole-filesystem remote workspace by default.
  • No secret-file exposure by default.
  • No silent continuation after restart or retry.

Route governed

Evidence First

The governance layer records verifier-safe metadata, hashes, and event summaries. It should not store raw secrets, credential material, or private customer content in public ledgers.