GovernorAIby SentinelLayer Request a briefing
Find and qualify
Discovery & Shadow AIInventory the AI activity nobody registered AssuranceEvaluate an agent snapshot before production
Decide and enforce
Policy & GovernanceKeep the policy engine you already run Runtime EnforcementDecide at the action boundary Inference & Model GovernanceGovern the model call itself Multi-cloudOne policy, each cloud's own controls
Prove and observe
Evidence & ComplianceTamper-evident record, mapped to controls Decision ObservabilitySee the decision behind the action
Risk and security
RiskScore the action, and act on the score ContainmentStop a runaway run before it lands Security architectureHow the control plane itself is built
By persona
SecurityPer-call authorization and stop controls GRCEvidence chains and control mapping Platform & AI EngineeringGovern without touching the agent
By risk
Shadow AIUnmanaged agents and connections Data leakageIn prompts, completions and tool calls Destructive actionsChanges to systems of record
By platform
AWS BedrockInbound path, guardrail attachment ServiceNowNow Assist discovery and scoped control SalesforceAgentforce and Einstein Bots, in-org MCPRegistry, proxy, argument-aware inspection
By cloud and runtime
AzureConnect, discover, govern at the gateway Google CloudValidated connect mode, bootstrap session DatabricksCluster-side egress, pinned at create Kubernetes & sidecarIn your cluster, on the agent host

USE CASES / SALESFORCE

Decide before the native tool runs.

An Agentforce agent or Einstein Bot executes inside Salesforce, on Salesforce's own runtime. Governing it from outside is not possible — so GovernorAI ships a managed package that places a decision step on the agent's path, inside the org, before the tool fires.

Agentforce, Einstein Bots, Flow Decision-only — no double execution Named Credential, no secret in Apex
A DECISION STEP PLACED INSIDE THE ORG 01 EnableAgent writes GovernorAI_Config__mdt through the Tooling API 02 Agent runs on Salesforce's own runtime outside our reach 03 Invocable action POST /api/v1/saas/salesforce/check/{agent_id} Named Credential 04 Verdict returns decision · reason · policy_id · rule_id · action_id X-Governor-Proxy-Secret 05 The flow branches before the native tool fires decision only, never execute-through Not an execute-through proxy. An allow would forward once, and the bot would then call the tool again.

An Agentforce agent runs on Salesforce's own runtime, so governing it from outside is not possible. The managed package puts a decision step on the agent's path, inside the org, before the tool fires.

decision onlyin-orgApex not yet org-tested

TWO TOPOLOGIES

Where the agent runs decides how it is governed.

Salesforce appears on both sides of the boundary, and the two cases need different mechanisms.

Topology
How the decision is applied
A — Salesforce as a tool
An external agent calls Salesforce as a downstream system. The execute-through proxy governs the call and, on allow, forwards it to Salesforce and streams the response back.
B — agent inside Salesforce
An Agentforce agent, Einstein Bot or Flow runs in the org. An invocable Apex action calls the decision-only check endpoint before the native tool executes, and the agent branches on the verdict.

Topology B deliberately does not use the execute-through proxy. If it did, an allow would have already forwarded the request to Salesforce once — and the bot would then call the tool again. Decision-only means the tool runs at most once, after allow.

THE MANAGED PACKAGE

What gets installed in the org.

01
The control plane enrols the agentEnableAgent writes a GovernorAI_Config__mdt custom metadata record through the Tooling API, carrying the agent's governance state, its per-agent gateway URL and the shared proxy secret.
02
The customer adds the actionThe GovernorAI Check invocable action goes into the Agentforce action list, the Einstein Bot dialog, or the Flow — wherever the decision belongs.
03
The action asks for a verdictIt reads the metadata record, then POSTs the tool name and arguments to /api/v1/saas/salesforce/check/{{agent_id}} through a Named Credential, authenticated with X-Governor-Proxy-Secret.
04
The gateway answers and recordsPolicy is evaluated, an audit event is emitted, and the response carries decision, reason, policy_id, rule_id and action_id — enough to show why, not just what.
05
The agent branchesAllow, deny or pause is applied by the agent's own logic before the native tool is invoked.

The package also carries the Named Credential and External Credential principal, so the shared secret is held by Salesforce's credential store rather than written into Apex, plus a permission set scoping who may invoke the action.

Honesty note

The package is required for any per-agent governance. Without it installed and the agent enrolled, enabling a Salesforce agent in GovernorAI annotates the agent's Description field and nothing more — a cosmetic change with no runtime effect. The tool calls bypass governance entirely. That is stated here because a governance product that silently does nothing is worse than one that says it is not connected.

Validation status. The Go backend is fully unit-tested. The Apex and metadata source has been through one scratch-org attempt, and it did not pass. A Dev Hub run created the org — after two feature names in the scratch-org definition had to be dropped because Salesforce rejected them — and then failed at the first scenario, the package deploy itself, on the shape of the external-credential principal metadata. That blocker has since been fixed and the package now carries the current form. The re-run has not happened: it needs an operator with Dev Hub access and, for the Agentforce and Einstein Bot scenarios, the licences those surfaces require. Until that run passes end to end, treat the in-org path as unproven against a real org.

Distribution. Operator-installed. The package is delivered by direct metadata deploy into the org. An AppExchange listing is a deferred decision rather than a closed one — the reasoning on record is that private distribution iterates faster while the enablement contract is still settling across real installs.

Continue

ServiceNowThe same pattern, as a scoped app IntegrationsEvery enforcement point in one table Runtime EnforcementDecide at the action boundary