# GovernWorld Enterprise AI Governance Platform — Full Specification

Version: 1.1.0
Vendor: ACR-LOGIC / Andres Chavez Ramirez
Website: https://governworld.acrlogic.com
Repository: https://github.com/ACR-LOGIC/governworld

---

## 1. Executive Summary

GovernWorld is an Enterprise AI Governance Enforcement Gateway designed to secure, monitor, and enforce compliance across AI system invocations, LLM agent workflows, and Model Context Protocol (MCP) integrations. It provides real-time bidirectional scanning, token-level redaction, policy-driven transformation, step-up authentication, and tamper-evident cryptographic audit logs.

---

## 2. Platform Architecture

### 2.1 13-Stage Governance Runtime Execution Pipeline
1. `received`: Inbound payload ingested from client SDK, proxy gateway, or browser extension.
2. `authenticated`: Verification of identity context, bearer tokens, or OIDC JWTs.
3. `tenant-resolved`: Workgroup, tenant isolation, and tenant-scoped policy binding.
4. `normalized`: Canonically formatted payload structure (JSON, plain text, multipart).
5. `classified`: Rule-based and classifier-based detection of sensitive entities and threat vectors.
6. `policy-evaluated`: Execution of governance rules against classified metadata.
7. `transformed`: Inbound transformation (e.g. tokenizing PII/PHI, masking credentials).
8. `egress-authorized`: Verification that external provider or target URI is permitted by egress policy.
9. `dispatched`: Safe forward to downstream model provider (OpenAI, Anthropic, Azure OpenAI, custom endpoints).
10. `output-received`: Downstream response captured by runtime gateway.
11. `output-scanned`: Outbound scan for data leakage, hallucinated credentials, or prohibited topics.
12. `output-transformed`: Outbound response transformation applied prior to client return.
13. `evidence-committed`: Cryptographic evidence bundle generated, hashed into Merkle chain, and written to outbox.

### 2.2 Failure Dispositions
Every evaluation stage resolves to one of 5 canonical failure dispositions:
- `DENY`: Absolute block of request execution.
- `REQUIRE_REVIEW`: Request routed to human operator / break-glass queue.
- `DEGRADE`: Sensitive fields stripped; request proceeds with reduced scope.
- `RETRY`: Transient downstream failure; retried with exponential backoff.
- `ABORT`: Catastrophic runtime invariant breach; immediate circuit break.

---

## 3. Core Modules & Subsystems

### 3.1 Detection & Redaction
- 50+ entity types supported: Social Security Numbers, Credit Card Numbers, Healthcare Identifiers (MRN, NPI, ICD-10), Financial Identifiers (IBAN, SWIFT, Routing), Credentials (AWS keys, GCP service accounts, SSH keys, Bearer tokens, GitHub Personal Access Tokens).
- Fast deterministic regex engine combined with zero-width whitespace / obfuscation resilience.

### 3.2 Agent & MCP Tool Governance
- Schema verification for Model Context Protocol (MCP) tool declarations.
- Dynamic allowlist enforcement preventing LLMs from calling arbitrary command execution, network egress, or unapproved API endpoints.

### 3.3 Cryptographic Audit Ledger
- SHA-256 Merkle-tree chaining for audit events.
- Outbox pattern ensuring zero-loss event persistence to PostgreSQL Flexible Server.
- BYOS (Bring Your Own Storage) integration for encrypted S3 / Azure Blob audit archives.

---

## 4. Public API & Integration Surfaces

- API Gateway Base URL: `https://api.governworld.acrlogic.com`
- Web Console: `https://governworld.acrlogic.com/console`
- Browser Redaction Extension: Chrome & Firefox web extension for browser-side PII scanning.
- Node.js / TypeScript SDK: `@acr-logic/governworld` NPM package.

---

## 5. Public Canonical Page Registry

- Home / Landing: `https://governworld.acrlogic.com/`
- Product Architecture: `https://governworld.acrlogic.com/product`
- Platform Blueprint: `https://governworld.acrlogic.com/platform`
- Security & Compliance: `https://governworld.acrlogic.com/security`
- AI Agent Governance: `https://governworld.acrlogic.com/ai-agents`
- Pricing & Tiers: `https://governworld.acrlogic.com/pricing`
- Integration Docs: `https://governworld.acrlogic.com/docs`
- Developer SDK: `https://governworld.acrlogic.com/sdk`
- System Status: `https://governworld.acrlogic.com/status`
- Subprocessors: `https://governworld.acrlogic.com/subprocessors`
- Privacy Policy: `https://governworld.acrlogic.com/privacy`
- Terms of Service: `https://governworld.acrlogic.com/terms`