Core Governance Vocabulary

Core SDK And Governance

Cross-cutting agentic AI OTel SDK enumeration library and GRC governance vocabulary. This file is the required foundation, all industry vertical files extend it. Contains the gen_ai.* namespace attributes, agent governance and safety enums, cross-cutting data governance, OTel metrics catalog, and OPA Rego policy patterns.

Back to industry coverage library

This page shows selected examples and categories. Download the JSON for the complete vocabulary, including every field, permitted value, and policy pattern in this catalog.

How to use this reference

1. Start with the core file if you need the cross-industry governance baseline.
2. Choose an industry file for its workflow fields and permitted values.
3. Match the OTel attributes to the policy paths your rules use, then verify the recorded fields in a test session.

Vocabulary file

• Download filename: 00_core_sdk_and_governance.json
• Kind: core
• Loading order: Load 00_core_sdk_and_governance.json first, then the relevant industry vertical file(s). The agent_registry_schema, audit_log_schema, hitl_task_schema, and policy_rule_schema in this file are the shared contracts consumed by the GRC portal regardless of vertical.

OTel namespaces

Implementation examples

• Core Agentic SDK Library: Agent Autonomy Level. Drive OPA rules requiring HITL approval for supervised_autonomous and fully_autonomous agents on tier_3 or tier_4 risk tasks. (Eu AI Act: Article 14, Human oversight measures)
• Core Agentic SDK Library: Agent Role Kind. Multi-agent topology mapping; scope least-privilege tool grants per role; inter-agent trust policy scoping.
• Core Agentic SDK Library: Tool Type. Require HITL for payment, computer_use, and identity_verification when risk_tier >= tier_3. (Eu AI Act: Article 13, Transparency obligations)
• Core Agentic SDK Library: Output Confidence Tier. Require HITL review when confidence_tier is very_low or low on high-value, high-impact, or irreversible actions. (Nist AI 600 1: MEASURE 2, MANAGE 2 - uncertainty and output quality management)

Control ideas

These patterns describe possible controls, not active rules. Confirm applicability, implement the control, and test its effect on the application.

Enforce before the action

Pass the request and your business action to this function. The core SDK checks policy before the action runs and again before its result is released. A deny or review decision means the action never runs.

import { Veriproof } from '@veriproof/sdk-core';
import type { GovernedResult, IndustryFact, JsonValue } from '@veriproof/sdk-core';

const veriproof = Veriproof.fromEnv();

export async function runProtectedAction<TInput extends JsonValue, TValue>(
  request: TInput,
  action: (input: TInput, signal: AbortSignal) => Promise<TValue>,
): Promise<GovernedResult<TValue, TInput>> {
  // Catalog values for this vertical. Replace them with facts from the current workflow.
  const industry: IndustryFact[] = [
    { attribute: "gen_ai.operation.name", policyInput: "gen_ai_operation_name", value: "chat" },
    { attribute: "gen_ai.task.state", policyInput: "gen_ai_task_state", value: "created" },
    { attribute: "gen_ai.task.status", policyInput: "gen_ai_task_status", value: "success" },
  ];

  // Policy runs before action() and again before the result is released.
  // A deny or review decision means action() never runs.
  return veriproof.govern(
    "00.core.sdk.and.governance.evaluate",
    request,
    ({ input, signal }) => action(input, signal),
    { industry },
  );
}

• Replace the sample values with facts from the current workflow. Rules read them under input.snapshot.industry.
• Test both permitted and blocked actions. Confirm that a blocked action never reaches your business function.
• Only completed, completed_with_warning, and transformed results carry a released value.

For review decisions, follow the Human Review guide to configure continuation. Observe remains available when you need to record activity without enforcing a decision.

Choose an industry SDK quickstart. See the API reference for TypeScript, Python, or .NET.

Selected vocabulary categories

This page uses the vocabulary JSON distributed with the documentation. Check its version when comparing it with an installed SDK.

Download the vocabulary JSON for offline review or automated comparisons.

Use the SDK reference for configuration and supported APIs. Keep vocabulary selection separate from the compliance team's assessment of applicable requirements.