unsupported_builtinThe policy uses a Rego built-in with no equivalent in the target provider's control model.
PLATFORM / MULTI-CLOUD
One policy. Compiled to each cloud's own controls.
Every cloud has its own guardrail format, and a policy written three times drifts three ways. GovernorAI compiles one governance policy into the native control configuration of each supported provider — and where a policy cannot be expressed in a target, it says so and refuses rather than emitting something weaker.
One source policy Provider-native output Refuses rather than degrades
THE COMPILER
Rego in. Provider-native configuration out.
Compilation, not translation at runtime. The policy is parsed statically — using OPA's AST parser rather than its evaluation engine — into an intermediate Common Policy Model, and each provider adapter renders that model into the format that provider actually accepts.
Source
One Rego policy
The policy your platform team already reviews, in the language they already use.
→
Common Policy Model
Parsed, not executed
OPA's AST parser reads the policy statically and produces a provider-neutral model. Nothing is evaluated to build it.
→
Adapters
Native configuration
Each target renders the model into its own control format, or reports that it cannot.
Target
What it compiles to
AWS Bedrock
Compiled to Bedrock Guardrail JSON.
aws_bedrockAzure OpenAI
Compiled to an Azure OpenAI RAI policy.
azure_openaiGoogle Vertex AI
Compiled to Vertex AI / Model Armor configuration.
gcp_vertexTwo U.S. provisional applications are on file.
DIVERGENCE IS PRINTED
A policy that cannot be compiled fails with a named reason.
This is the part that makes the rest usable. A compiler that silently drops what it cannot express produces a config that looks complete and enforces less than the policy said — the worst possible outcome for a governance artefact. Three reasons are produced today; the error contract reserves a fourth that no validator currently emits.
external_dataThe policy consults data the provider control cannot reach at decision time.
non_deterministicReserved, not yet emitted. The contract defines it for a policy that would not resolve the same way twice; no validator produces it today.
wrong_packageThe policy is not in the governance package the compiler reads.
Where a source location applies, the error identifies it — an unsupported built-in or an external-data lookup points at the line to change. A package-level rejection has no single line to name, and does not invent one.
THE OTHER HALF
Compilation covers the model call. The action is governed at runtime.
Native guardrails protect what a model is asked and what it answers. They do not govern an agent writing to a system of record — and most SaaS platforms expose no guardrail format to compile into at all. Those are governed at the action boundary instead.
Layer
How a policy reaches it
Supported cloud AI providers
Bedrock · Azure OpenAI · Vertex
Bedrock · Azure OpenAI · Vertex
Compiled into the provider's native guardrail configuration by the process above.
SaaS and agent runtimes
Salesforce · ServiceNow · MCP · frameworks
Salesforce · ServiceNow · MCP · frameworks
Evaluated at runtime and enforced at the action boundary before the system of record changes. There is no policy compiler for these platforms, and none is claimed — see Runtime Enforcement and Integrations.
The two are complementary rather than alternatives. A guardrail compiled into Bedrock constrains the model interaction; the action boundary decides whether the resulting tool call is allowed to change anything.
WHERE THIS SITS
The provider pages, and what connects them.
Each cloud has its own page describing connection, discovery and which outcomes its enforcement point can execute. This is the layer above them.
Provider
Its page covers
Inbound path with guardrail attachment — the one target where shaped arguments are materialised end to end today.
Short-lived bootstrap connection, Azure AI account discovery, request-side outcomes.
Validated connect mode, Vertex AI discovery, request-side outcomes.
Cluster-side egress pinned at cluster creation.
Sidecar and mesh insertion in your own cluster.
STATED PRECISELY
What compilation produces today.
Stated precisely Compiled provider configurations are declarable and attestable artefacts. Runtime enforcement runs through the GovernorAI action boundary.
The compiler produces the native configuration and the record that it was produced from a reviewed policy. Attaching that configuration to the provider automatically is not claimed here.
Honesty note
Three targets are supported — Bedrock, Azure OpenAI and Vertex. That is not every cloud service you run, and a provider absent from the list is absent from the compiler, not silently handled by a fallback.
Native provider attach — pushing a compiled configuration into the provider and keeping it in sync — is roadmap rather than shipped. Until it lands, the compiled artefact is something you declare and attest with, and enforcement for those calls happens at the action boundary described on Runtime Enforcement.
IN THE PRODUCT
The surface this page describes.
