Governance

Capabilities in the `governance` group, auto-generated from defineCapability() declarations.

Governance

GET /auth/governance/audit/chain/verify

Verify the hash-chain integrity of the tenant's recent audit window

Capability ID: auth.governance.audit.chainVerify Auth: supabaseJwt Permission: governance.read

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "limit": {
      "type": "string"
    },
    "since": {
      "type": "string"
    }
  },
  "additionalProperties": false
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

chain

Request:

{}

Response:

{
  "valid": true
}

---

GET /auth/governance/audit/ledger

Recent chained audit rows projected for the Ledger view (+ head hash)

Capability ID: auth.governance.audit.ledger Auth: supabaseJwt Permission: governance.read

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "outcome": {
      "type": "string"
    },
    "limit": {
      "type": "string"
    },
    "since": {
      "type": "string"
    }
  },
  "additionalProperties": false
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

ledger

Request:

{
  "limit": "50"
}

Response:

{
  "rows": [],
  "head_hash": null
}

---

POST /auth/governance/audit/sign

Detached tenant-HMAC over a caller-supplied entry. NOT evidence minting — see /v1/governance/artifacts/{request_id}

Capability ID: auth.governance.audit.sign Auth: supabaseJwt Permission: governance.audit.sign

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "entry": {
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    }
  },
  "required": ["entry"],
  "additionalProperties": false
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

sign

Request:

{
  "entry": {
    "kind": "test"
  }
}

Response:

{
  "entry": {
    "kind": "test"
  },
  "hmac": "...",
  "keyVersion": "v1"
}

---

POST /auth/governance/audit/verify

Check a detached tenant-HMAC. NOT evidence verification — see POST /v1/governance/audit/verify

Capability ID: auth.governance.audit.verify Auth: supabaseJwt Permission: governance.audit.verify

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "entry": {
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    },
    "hmac": {
      "type": "string"
    }
  },
  "required": ["entry", "hmac"],
  "additionalProperties": false
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

verify

Request:

{
  "entry": {},
  "hmac": "..."
}

Response:

{
  "valid": true
}

---

DELETE /auth/governance/behavioral-profiles/{role}

Delete a behavioral profile by role (admin)

Capability ID: auth.governance.behavioral_profiles.delete Auth: supabaseJwt Permission: governance.behavioral_profiles.write

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "role": {
      "type": "string"
    }
  },
  "required": ["role"],
  "additionalProperties": false
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

delete

Request:

{
  "role": "agent"
}

Response:

{
  "deleted": true
}

---

GET /auth/governance/behavioral-profiles

List behavioral profiles for the tenant

Capability ID: auth.governance.behavioral_profiles.list Auth: supabaseJwt Permission: governance.behavioral_profiles.read

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

list

Request:

{}

Response:

{
  "profiles": []
}

---

PUT /auth/governance/behavioral-profiles/{role}

Create or update a behavioral profile for a role (admin)

Capability ID: auth.governance.behavioral_profiles.update Auth: supabaseJwt Permission: governance.behavioral_profiles.write

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "role": {
      "type": "string"
    },
    "maxRps": {
      "type": "number"
    },
    "maxPayloadBytes": {
      "type": "number"
    },
    "allowedDestinations": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "maxFanOut": {
      "type": "number"
    },
    "maxRequestsPerWindow": {
      "type": "number"
    },
    "windowSeconds": {
      "type": "number"
    }
  },
  "required": ["role"],
  "additionalProperties": false
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

upsert

Request:

{
  "role": "agent",
  "maxRps": 10
}

Response:

{
  "profile": {
    "role": "agent"
  }
}

---

GET /auth/governance/compliance

PII scan over the tenant's core memory entries

Capability ID: auth.governance.compliance Auth: supabaseJwt Permission: governance.compliance.read

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

compliance

Request:

{}

Response:

{
  "total_entries": 0,
  "violations_found": 0,
  "compliant": true
}

---

GET /auth/governance/plans

List the tenant's request-scoped liaison plans (read-only; distinct from grants)

Capability ID: auth.governance.plans Auth: supabaseJwt Permission: governance.read

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "limit": {
      "type": "string"
    }
  },
  "additionalProperties": false
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

plans

Request:

{}

Response:

{
  "liaisons": [],
  "count": 0
}

---

POST /auth/governance/policy/dry-run

Dry-run the tenant policy engine against a hypothetical action

Capability ID: auth.governance.policy.dry_run Auth: supabaseJwt Permission: governance.policy.dry_run

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "action": {
      "type": "string"
    },
    "actor": {
      "type": "object",
      "propertyNames": {
        "type": "string"
      },
      "additionalProperties": {}
    },
    "target": {},
    "category": {
      "type": "string"
    },
    "agentId": {
      "type": "string"
    },
    "toolName": {
      "type": "string"
    },
    "toolNames": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "modelName": {
      "type": "string"
    }
  },
  "additionalProperties": {}
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

dry-run

Request:

{
  "action": "agent.create"
}

Response:

{
  "decision": "allow"
}

---

POST /auth/governance/scope-check

Dry multi-source scope composition (per-source lanes, no enforcement side effects)

Capability ID: auth.governance.scope_check Auth: supabaseJwt Permission: governance.read

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "requested": {
      "type": "object",
      "properties": {
        "models": {
          "minItems": 1,
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "required": ["models"],
      "additionalProperties": false
    },
    "sources": {
      "type": "object",
      "properties": {
        "api_key": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "br_scope": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "plan": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "delegation": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "additionalProperties": false
    }
  },
  "required": ["requested"],
  "additionalProperties": false
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

scope-check

Request:

{
  "requested": {
    "models": ["anthropic/claude-sonnet-4"]
  },
  "sources": {}
}

Response:

{
  "results": []
}

---

GET /auth/governance/scope-enforcement

Per-source scope enforcement: configured vs effective (cohort-aware, R6)

Capability ID: auth.governance.scope_enforcement Auth: supabaseJwt Permission: governance.read

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

state

Request:

{}

Response:

{
  "sources": []
}

---

GET /auth/governance/would-deny

Would-deny preview: warn-mode denials over an adjustable lookback, deduped

Capability ID: auth.governance.would_deny Auth: supabaseJwt Permission: governance.read

Request schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "days": {
      "type": "string"
    }
  },
  "additionalProperties": false
}

Response schema

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "propertyNames": {
    "type": "string"
  },
  "additionalProperties": {}
}

Examples

preview

Request:

{
  "days": "7"
}

Response:

{
  "total": 0,
  "groups": []
}

---