GovernorAIby SentinelLayer Request a briefing
Find and qualify
Discovery & Shadow AIInventory the AI activity nobody registered AssuranceEvaluate an agent snapshot before production
Decide and enforce
Policy & GovernanceKeep the policy engine you already run Runtime EnforcementDecide at the action boundary Inference & Model GovernanceGovern the model call itself Multi-cloudOne policy, each cloud's own controls
Prove and observe
Evidence & ComplianceTamper-evident record, mapped to controls Decision ObservabilitySee the decision behind the action
Risk and security
RiskScore the action, and act on the score ContainmentStop a runaway run before it lands Security architectureHow the control plane itself is built
By persona
SecurityPer-call authorization and stop controls GRCEvidence chains and control mapping Platform & AI EngineeringGovern without touching the agent
By risk
Shadow AIUnmanaged agents and connections Data leakageIn prompts, completions and tool calls Destructive actionsChanges to systems of record
By platform
AWS BedrockInbound path, guardrail attachment ServiceNowNow Assist discovery and scoped control SalesforceAgentforce and Einstein Bots, in-org MCPRegistry, proxy, argument-aware inspection
By cloud and runtime
AzureConnect, discover, govern at the gateway Google CloudValidated connect mode, bootstrap session DatabricksCluster-side egress, pinned at create Kubernetes & sidecarIn your cluster, on the agent host

USE CASES / GOOGLE CLOUD

The connection states what it is.

A cloud connection that is labelled production-safe when it is actually a debug credential is worse than no label. GovernorAI persists the connect mode explicitly, validates it against the credential you supplied, and refuses the pair if they disagree.

Explicit, persisted connect mode Credential shape validated Short-lived bootstrap session
THE CONNECTION STATES WHAT IT IS ACCEPTED mode: production credential shape agrees with the declared mode REJECTED mode: production · credential: debug rejected with an operator-facing error, never persisted A cloud connection labelled production-safe when it is a debug credential is worse than no label at all.

The mode is explicit, persisted, and validated against the shape of the credential. If the two disagree the request is rejected with an operator-facing error and nothing is written — the same contract runs across AWS, Azure and GCP.

mode persistedmismatch rejectednever persisted on disagreement

THE CONNECT-MODE CONTRACT

Why a mismatch is rejected rather than stored.

The same contract runs across AWS, Azure and GCP, so an operator learns it once.

Behaviour
Reason
The mode is explicit and persisted
The connection carries a declared mode rather than one inferred at read time, so what the console shows is what was agreed at setup.
The credential shape must match
If a supplied mode disagrees with the shape of the credential JSON, the request is rejected with an operator-facing error.
A mismatch is never persisted
Storing it would let the connection be stamped with the wrong production-safe or debug-only badge — breaking the contract the setup wizard made with the operator up front.

BOOTSTRAP

Attaching a project.

01
A temporary session is mintedA short-lived token is issued for the bootstrap, rather than a standing service-account key being handed over.
02
Deployment is probed, not assumedThe bootstrap deploys through Deployment Manager and probes the result, so a partial deployment is detected rather than reported as success.
03
Handoff is durableThe transition from bootstrap credential to steady-state connection is handled as a durable step, so a failure mid-handoff does not leave an ambiguous connection.
04
The session is sweptBootstrap sessions are reclaimed, so temporary credentials do not outlive the operation that needed them.
Honesty note

As with Azure, this describes connection and discovery rather than a GCP-native inbound enforcement point. Enforcement on GCP goes through the enforcement points on the integrations page — a gateway hop, an LLM gateway, MCP, or the SDK. Those are shipped code; attaching one is a configuration step in your project, and connecting the project does not perform it.

Vertex has no persistent attachment point comparable to a Bedrock guardrail. Vertex's own safety controls are per-request settings carried on the call itself, so GovernorAI compiles them as output for you to embed in the SDK path — nothing is left on the Google side to read back afterwards. The nearest persistent target is Model Armor, which holds templates per project and location, and a GovernorAI policy compiles to one. That path is off unless you turn it on: the control plane installs a no-op GCP client unless GCP_MODEL_ARMOR_ENABLED is set to true with a project and location supplied, and it carries its own dry-run switch. Model Armor is also a narrower target than a Bedrock guardrail — it has no blocklist mechanism, tool-deny rules have nothing to map onto, and GovernorAI treats GCP as read-only for repair: a remediation plan aimed at a GCP target is refused on capability grounds rather than applied.

The multi-cloud compiler emits a GCP artifact and stops there. The shipped control plane wires a no-op cloud client for all six compile targets, so the artifact is something you can read and declare — not something the product applies to your project or checks back against afterwards.

Continue

AzureThe same model, different cloud IntegrationsEvery enforcement point in one table AWS BedrockA native inbound path