Deterministic governance engine

Same inputs. Same rules. Same decision.

GI/PPI evaluates proposals against fixed, versioned policies and returns allow or deny with explicit reason codes. Every decision is sealed into a hash-chained ledger you can replay later, so drift is visible instead of silent.

See how it works ▷ Read the paper

No randomness or hidden stateFails closedReplayable evidence

ledger / policy_decisionsSealed just now

Decision

// sealed decision record { "decision": "deny", "reason_codes": ["AI_PROTECTED_WRITE_FORBIDDEN"], "surface": "file.write", "origin": "ai", "policy_hash": "781c28e4...de318", "input_hash": "5b0e91c2...a7f04", "ledger_entry_hash": "20dc786b...f5eef", "prior_entry_hash": "c39a1f07...8d2b1" }

Replay

$ pwsh scripts/cg_replay_verifier_v1.ps1 policy 781c28e4 (pinned, activation #1) input 5b0e91c2 (canonical JSON, SHA-256) stored deny AI_PROTECTED_WRITE_FORBIDDEN replayed deny AI_PROTECTED_WRITE_FORBIDDEN MATCH identical decision, reasons and hashes

Replaying a decision recomputes it from the stored proposal and the pinned policy. A different result means tampering or unintended change. Values shown are illustrative.

✓Anchor verified
ledger head signed, P-256

0sources of randomness in the evaluator

SHA-256canonical input and ledger hashing

P-256signed ledger anchors

1,000×2randomized requests, identical twice (stress test)

Everything, sealed

From proposal to proof.

Deterministic evaluation

Inputs are canonicalized and hashed. Policies are pinned by hash. The evaluator does no I/O, reads no clock and has no hidden state.

Sealed, append-only ledger

Each decision is chained to the one before it. Editing any entry breaks the chain at that point, and signed anchors catch truncation or a rewritten history.

Replay and drift detection

Any decision can be re-run against the original proposal and policy version. If the answer changes, you find out immediately.

Built for AI-era work

Enforced where work actually happens.

The same engine sits in front of the places changes are made, and it denies by default when anything is missing or unclear.

Git hooks and a required CI check judge every commit, including AI-assisted ones.
A Claude Code hook and an MCP tool server govern what AI assistants may write, run or fetch.
Protected paths, secrets and destructive commands are blocked for AI, and gated to admins for people.

Explore enforcement

$ git commit -m "tweak policy" BLOCKED policy/enforce.strict.demo.v1.json surface=repo.change.apply origin=ai reason=AI_PROTECTED_WRITE_FORBIDDEN CovenantGate git gate: changes=1 blocked=1 $ CG_ROLE=admin git commit -m "tweak policy" ALLOW human admin, policy re-pinned CovenantGate git gate: changes=2 blocked=0

What it is not

An instrument, not an opinion.

GI/PPI is not an AI, not a recommendation system and not a probabilistic engine. Like a measurement device, it must return the same value when the same measurement is taken twice. If it cannot, it is considered broken.

TIGHTEN ONLY

Overlays can only restrict

Organizations add overlays to narrow what the base policy allows. Any overlay that would widen authorization fails closed when the policy loads.

METERED

Credits on the same ledger

Licensed entitlements meter evaluations through credits recorded with the same append-only, auditable principles as the decisions themselves.

FAIL CLOSED

Unclear means no

Missing config, a policy that no longer matches its pin, or a decision that cannot be recorded: every one of them is a deny.

Ready when you are

Governance you can measure.

Read the research behind GI/PPI, or ask for access to the engine and its evidence tooling.

Read the paper