Console Login
How It Works

Validate. Evaluate. Execute. Export evidence.

Gvner sits between agent intent and production execution. Agents propose actions, Gvner validates structure, evaluates policy centrally, then returns ALLOW or DENY with evidence.

Quickstart Integration Hub Unified Adapter Policy Rules Evidence Model
Book enterprise pilot Continue to Docs Back to Home

Canonical flow

1. Agent generates intent

The agent emits a structured intent with actor, action, target, and context. See Agent Inventory and Tool Policy.

2. Validate intent

The runtime calls Gvner before side effects happen: use /adapters/http/intent for generic integrations, or /openclaw/intent and /temporal/intent on compatibility paths. Execution is blocked until a signed decision is returned.

3. Evaluate policy

Gvner checks policy, identity authority, risk, budget, and compliance constraints. Related docs: Policies, Role Mapping, Identity Changes, Control Mapping.

4. Return ALLOW or DENY

The decision is deterministic, time-bound, and tied to policy basis. Every result is written to evidence and can be exported.

5. Execute only if allowed

ALLOW permits execution for the defined scope and time window. DENY blocks execution and records reason codes for review.

6. Export evidence

Decision and execution traces are packaged into evidence suitable for release, security review, and compliance conversations.

What a pilot proves

Technical proof

Intent validation before side effects
Explicit allow or deny
Approval-required branch

Buyer proof

Execution traceability
Evidence export for internal review
Repeatable onboarding for chosen workflow

Integration surfaces

Unified adapter (recommended)

Use one contract for LangGraph, Semantic Kernel, Bedrock, Vertex ADK, automation, and worker queues.

OpenClaw compatibility

Existing OpenClaw runtimes keep dedicated compatibility endpoints.

Temporal compatibility

Existing Temporal workflows keep dedicated activity-gating endpoint.

Full integration hub

All integration families, payload mappings, fail-closed behavior, and wrapper patterns.

What gets evaluated

Policy constraints

Deterministic rule checks on action type, scope, and environment.

Identity authority

SSO/SCIM, role mapping, session policy, and approval requirements.

Operational limits

SLA budgets, readiness state, and incident conditions.

Security/compliance controls

Control coverage, least privilege, and fail-closed behavior.

Governance OS layers

Execution authority

Explicit ALLOW/DENY decisions gate all execution.

Identity governance

SSO, SCIM, roles, sessions, and change approvals are policy-bound.

Evidence exports

Ledger, packet, receipt, and regulator exports with verification.

Operational oversight

Readiness, observability, failover, restore drills, and SLA tracking.

Example flow

Below is a representative example showing the intent → decision → audit cycle.

Intent Submission
{ "agent_id": "agent_7f3a21", "action": "database.update", "target": "customers.email", "parameters": { "customer_id": "cust_8492", "new_email": "updated@example.com" }, "context": { "user_request": "Update customer email", "timestamp": "2026-02-27T14:32:11Z" } }
Gvner Decision
{ "decision": "ALLOW", "basis": { "policy": "COMPLIANT - customer_data_update_v2", "permits": "AUTHORIZED - agent_7f3a21 has UPDATE_CUSTOMER", "budget": "AVAILABLE - 847 operations remaining", "regulation": "COMPLIANT - GDPR Article 16" }, "audit_id": "aud_9f2e4c1a8b7d6f3e", "timestamp": "2026-02-27T14:32:11.247Z", "expires_at": "2026-02-27T14:32:16.247Z" }
Audit Record
{ "audit_id": "aud_9f2e4c1a8b7d6f3e", "work_id": "work_4e7f2a9c", "agent_id": "agent_7f3a21", "action": "database.update", "decision": "ALLOW", "executed": true, "execution_timestamp": "2026-02-27T14:32:11.891Z", "evidence_hash": "sha256:7f3e9a2c1d8b4f6e...", "immutable": true }

Operate this in production

Observe

Start with observability, performance targets, and SLO burn tracking.

Harden

Use readiness checks, maintenance controls, and restart advisories.

Recover

Run support packs, launch packs, failover rehearsal, and restore drills.

Scale

Use org-level dashboards for cross-tenant incidents, errors, and SLA.

Key guarantees

Every decision is logged with complete context
Decisions are deterministic and reproducible
No execution can bypass Gvner evaluation
Audit trails are immutable and cryptographically verifiable
Fail-Closed Design Audit Trail Receipts Regulator Packet

Call to Action

Use Gvner to move from agent experimentation to controlled production execution.

Book enterprise pilot Talk to sales Continue to Docs Integration Hub Start Generic Adapter