Console Login
How It Works

How It Works

Gvner is the decision layer between agent intent and production execution. Agents propose actions, Gvner evaluates policy and authority, then returns ALLOW or DENY with immutable evidence.

Quickstart Integration Hub Unified Adapter Policy Rules Evidence Model
Continue to Docs Back to Home

Canonical flow

1. Agent generates intent

The agent emits a structured intent with actor, action, target, and context. See Agent Inventory and Tool Policy.

2. Intent sent to Gvner

The runtime calls Gvner before side effects happen: use /adapters/http/intent for generic integrations, or /openclaw/intent and /temporal/intent on compatibility paths. Execution is blocked until a signed decision is returned.

3. Gvner evaluates

Gvner checks policy, identity authority, risk, budget, and compliance constraints. Related docs: Policies, Role Mapping, Identity Changes, Control Mapping.

4. Gvner returns ALLOW or DENY

The decision is deterministic, time-bound, and tied to policy basis. Every result is written to evidence and can be exported.

5. Execution only proceeds if allowed

ALLOW permits execution for the defined scope and time window. DENY blocks execution and records reason codes for review.

Integration surfaces

Unified adapter (recommended)

Use one contract for LangGraph, Semantic Kernel, Bedrock, Vertex ADK, automation, and worker queues.

OpenClaw compatibility

Existing OpenClaw runtimes keep dedicated compatibility endpoints.

Temporal compatibility

Existing Temporal workflows keep dedicated activity-gating endpoint.

Full integration hub

All integration families, payload mappings, fail-closed behavior, and wrapper patterns.

What gets evaluated

Policy constraints

Deterministic rule checks on action type, scope, and environment.

Identity authority

SSO/SCIM, role mapping, session policy, and approval requirements.

Operational limits

SLA budgets, readiness state, and incident conditions.

Security/compliance controls

Control coverage, least privilege, and fail-closed behavior.

Governance OS layers

Execution authority

Explicit ALLOW/DENY decisions gate all execution.

Identity governance

SSO, SCIM, roles, sessions, and change approvals are policy-bound.

Evidence exports

Ledger, packet, receipt, and regulator exports with verification.

Operational oversight

Readiness, observability, failover, restore drills, and SLA tracking.

Example flow

Below is a representative example showing the intent → decision → audit cycle.

Intent Submission
{ "agent_id": "agent_7f3a21", "action": "database.update", "target": "customers.email", "parameters": { "customer_id": "cust_8492", "new_email": "updated@example.com" }, "context": { "user_request": "Update customer email", "timestamp": "2026-02-27T14:32:11Z" } }
Gvner Decision
{ "decision": "ALLOW", "basis": { "policy": "COMPLIANT - customer_data_update_v2", "permits": "AUTHORIZED - agent_7f3a21 has UPDATE_CUSTOMER", "budget": "AVAILABLE - 847 operations remaining", "regulation": "COMPLIANT - GDPR Article 16" }, "audit_id": "aud_9f2e4c1a8b7d6f3e", "timestamp": "2026-02-27T14:32:11.247Z", "expires_at": "2026-02-27T14:32:16.247Z" }
Audit Record
{ "audit_id": "aud_9f2e4c1a8b7d6f3e", "work_id": "work_4e7f2a9c", "agent_id": "agent_7f3a21", "action": "database.update", "decision": "ALLOW", "executed": true, "execution_timestamp": "2026-02-27T14:32:11.891Z", "evidence_hash": "sha256:7f3e9a2c1d8b4f6e...", "immutable": true }

Operate this in production

Observe

Start with observability, performance targets, and SLO burn tracking.

Harden

Use readiness checks, maintenance controls, and restart advisories.

Recover

Run support packs, launch packs, failover rehearsal, and restore drills.

Scale

Use org-level dashboards for cross-tenant incidents, errors, and SLA.

Key guarantees

Every decision is logged with complete context
Decisions are deterministic and reproducible
No execution can bypass Gvner evaluation
Audit trails are immutable and cryptographically verifiable
Fail-Closed Design Audit Trail Receipts Regulator Packet

Call to Action

Use Gvner to move from agent experimentation to controlled production execution.

Continue to Docs Integration Hub Start Generic Adapter