Governance and audit
Governance is the layer that judges actions, not just context. It is what has no analogue in a retrieval system.
Producing a verdict
Section titled “Producing a verdict”You describe what you are about to do — the action type, the files, the scope, a summary. Vectadyne finds what the corpus knows about those specific things and evaluates it.
Reasons, not just a decision
Section titled “Reasons, not just a decision”Every verdict carries reasons, each with a severity and citations:
| Reason | Fires when |
|---|---|
regression_recurrence | this change resembles one that broke before |
fragile_file | this file has a history of causing incidents |
contradicts_decision | this contradicts a recorded decision |
violates_policy | a policy prohibits it |
requires_approval | policy requires a human |
stale_memory_conflict | relevant memory has aged past confidence |
disputed_memory | the supporting memory is contested |
missing_required_check | a required check has not run |
sensitivity_block | the action touches memory above clearance |
guide_prohibition | a topic guide prohibits it |
low_confidence_advisory | weak signal, surfaced honestly |
A bare block is not useful. block because violates_policy, citing the policy and the evidence
behind it, is something an engineer can act on or argue with.
The four decisions
Section titled “The four decisions”| Decision | Meaning | Your agent |
|---|---|---|
allow | Nothing known against it | proceeds |
warn | Something worth knowing; not disqualifying | proceeds, with advisories in front of the model |
block | Recorded knowledge says do not | holds |
require_approval | A human must sign off | holds |
warn proceeding is the advisory-first thesis in one row. If you treat
warn as a stop, you have built the inline gate this is designed not to be.
Any decision a client does not recognise is treated as a hold. All three SDKs fail closed there.
The audit record
Section titled “The audit record”Every governed call records what was known, what was decided, which principal asked, and when.
The value is reconstructive. After an incident, “the agent did the wrong thing” and “the agent did
the wrong thing and here is exactly what it had been told” are different investigations. Combined
with as_of time travel, you can replay what an
agent would have been told at any past moment and distinguish:
- the agent was never told — a corpus gap; fix the evidence
- the agent was told and ignored it — an integration gap; fix the branch
- the agent was told something wrong — a memory quality problem; fix the record
Those three have completely different fixes, and without the record you cannot tell them apart.
Machine principals have their own trail
Section titled “Machine principals have their own trail”Anything running unattended should have its own identity, so the audit trail says which agent did what rather than which human’s token it borrowed. See Enrol a machine principal.
Where enforcement actually lives
Section titled “Where enforcement actually lives”Three lanes, and only one of them is advisory:
Read Advisory-first before you rely on any of them.
No SOC 2
Section titled “No SOC 2”There is no attestation. The audit export is the artifact — a complete record you can pull and hand to whoever is asking. See What we do not claim.