# governance-sdk

> Runtime governance for TypeScript AI agents. Policy enforcement, audit trails, scoring, injection detection, and EU AI Act compliance.

## Docs

### Getting Started

- [Overview](/docs): Complete documentation for governance-sdk — the governance SDK for TypeScript AI agents.
- [Quickstart](/docs/quickstart): Add governance to your TypeScript AI agents in under 5 minutes. No API keys, no external services, no runtime dependencies.
- [Concepts](/docs/concepts): How governance works: the mental model behind agents, policies, enforcement, and scoring.

### Core Features

- [Policies & Rules](/docs/policies): 9 core presets + 12 extended presets + ML classifier hook. Condition types, boolean combinators, priority clamp.
- [Governance Scoring](/docs/scoring): 7-dimension governance scoring model with L0-L4 maturity levels for AI agent assessment.
- [Kill Switch](/docs/kill-switch): Emergency agent shutdown at priority 999. Kill one agent or your entire fleet in a single call. Per-process in OSS; distributed in Cloud.

### Security & Compliance

- [Injection Detection](/docs/injection): Detect prompt injection attacks with 54 patterns across 7 categories. Zero dependencies, sub-millisecond. F1 ≈ 0.48 on the published benchmark — defense in depth, not a sole control.
- [Audit Trail](/docs/audit): Opt-in HMAC-SHA256 hash-chained audit trail for tamper-evident AI agent logging. Maps to EU AI Act Article 12 record-keeping.
- [EU AI Act Compliance Mapping](/docs/compliance): Self-assessment cross-reference of your governance to EU AI Act requirements. 6 articles, 18 requirements, deadline tracking. Not a certified audit; not legal advice.

### Infrastructure

- [Framework Adapters](/docs/adapters): First-class adapters for the major JS agent frameworks. One-line integration for Mastra, Vercel AI, LangChain, OpenAI Agents, Anthropic, Genkit, LlamaIndex, Mistral, Ollama — plus MCP and Bedrock.
- [Storage](/docs/storage): In-memory storage for development, PostgreSQL for production. Swap without code changes.

### API Reference

- [Overview](/docs/api-reference): Complete API reference for every exported function in governance-sdk.
- [Audit Chain](/docs/api-reference/audit): HMAC-SHA256 tamper-evident, append-only audit chain. Verify integrity, export logs, inspect stats.
- [Combinators](/docs/api-reference/combinators): Compose policy conditions with any_of (OR), all_of (AND), and not (NEGATE) combinators.
- [Compliance Mapping](/docs/api-reference/compliance): EU AI Act self-assessment across 6 articles. Per-article pass/fail with recommended next steps. Not legal advice.
- [Core Functions](/docs/api-reference/core): API reference for createGovernance, register, enforce, recordOutcome, audit, integrityChain, score, and scoreFleet.
- [Injection](/docs/api-reference/injection): Detect prompt injection attacks with 54 patterns across 7 categories. Sub-millisecond, zero dependencies. F1 ≈ 0.48.
- [Kill Switch](/docs/api-reference/kill-switch): Instantly kill and revive individual agents or your entire fleet. Priority 999 overrides all rules. Per-process in OSS.
- [Policy Presets](/docs/api-reference/policies): Complete API reference for all 8 policy presets in governance-sdk.
- [Scoring](/docs/api-reference/scoring): Compute governance scores across 7 dimensions. L0-L4 maturity levels with per-dimension breakdown.
- [Storage](/docs/api-reference/storage): In-memory and PostgreSQL storage adapters for governance-sdk. Swap backends with one line.