The /governance overview

What the /governance page shows today, where each governance number actually lives, and the setup-state signal behind the section.

/governance is the way into the AI Governance section rather than an oversight dashboard of its own. It opens with a greeting, one field for asking a question or jumping to a screen, an Add Source action for admins who may manage ingestion sources, and shortcuts to add people, an agent or a tool.

Under those sit two lists. Insights fills once your ingestion sources are pulling, and Recent activity lists the screens you were last on. Before your first source reports an event, each list carries one line saying what will fill it.

The page issues no spend, anomaly or source-health read of its own. That is deliberate: it used to carry a panel per subject, each on its own permission, so a reader whose plan or role did not cover one met an error before they met the page.

Pairs with: AI Governance, which describes this screen and the rest of the section in full.

Where the numbers live

This page carries no strips of metrics. Each subject has its own screen in the section:

To see	Go to
The systems reporting AI activity, and the tool catalog	Inventory
The agents and applications detected across the organization	Agents in the sidebar
Departments, and how spend rolls up by them	People

Alerts raised by the anomaly detector are listed on none of these. See Anomaly rules for where an alert does reach you.

When the section becomes an admin’s landing page

A setup-state signal decides whether an org admin is sent here, read by the governance.setupState({ organizationId }) tRPC procedure:

{
  hasPersonalVKs:       boolean,  // any user has minted a personal VK
  hasRoutingPolicies:   boolean,  // at least one routing policy exists
  hasIngestionSources:  boolean,  // at least one source exists
  hasAnomalyRules:      boolean,  // at least one rule defined
  hasRecentActivity:    boolean,  // any governance event in the last 30d
  hasApplicationTraces: boolean,  // an application project has traces
}

Governance reads as active when any one of the first five is true. hasApplicationTraces is reported alongside them and does not feed that answer.

The same signal backs the langwatch governance status output, so the CLI and the app agree on whether an organization has activated governance.

Permissions

Opening /governance needs governance:view, which an organization Admin holds by default.

The reads behind the section’s other screens are permissioned separately. The activity-monitor procedures cap at activityMonitor:view, the permission to grant a security analyst who should see activity without managing rules.

Where to next

• The section and its four pages: AI Governance.
• What the detector evaluates, and where an alert goes: Anomaly rules.
• Inspect ingestion-source health from the terminal: CLI debug.
• Export to your SIEM: Compliance architecture.
• Audit who did what when: Audit log.