govern
Enforce remote execution verdicts and signed Decision Dossiers before workflow steps run.
Gate deployments, migrations, and agent actions using remote Decionis verdicts and no local policy engine.
Govern is an open-source tool that intercepts workflow steps in CI/CD systems like GitHub Actions to evaluate execution intent via Decionis. It is built for DevOps, platform, and security professionals who need strict remote authority over deployments and AI agent actions.
What it is
The tool acts as a single-use execution gate, ensuring a command only runs if Decionis issues an ALLOW verdict. It produces a signed Decision Dossier for every audited action and can operate in shadow mode to log verdicts without failing builds.
Who it's for
It suits teams managing high-risk production deployments, infrastructure changes, or autonomous AI agent pipelines that require centralized governance. It does not suit environments seeking local policy evaluation engines or offline-only execution workflows.
Key features
Remote Execution Authority
Decides on execution intent remotely, treating an unreachable Decionis service as a hard refusal.
Signed Decision Dossier
Finalizes every governed workflow step into a verifiable, signed audit record.
Shadow and Enforce Modes
Run in shadow mode to record verdicts beside commands without failing builds, or enforce mode to block unauthorized actions.
Multi-Platform CI Support
Uses a single Go binary to support GitHub Actions, GitLab CI, Jenkins, and other runner environments.
Up and running in 3 steps
Our honest verdict
What's great
- Eliminates local policy engines entirely in favor of remote Decionis verdicts.
- Generates signed Decision Dossiers for every gated workflow step.
- Supports shadow mode for safe initial rollout without breaking active builds.
- Compatible with multiple CI/CD platforms including GitHub Actions, GitLab CI, and Jenkins.
Where it falls short
- Requires an active Decionis API connection; unreachable services result in immediate refusal.
- Dependency on the proprietary Decionis cloud API for all decision-making.
- Migrating from v1 requires updating configuration from org-id/workflow-key to tenant-id.
Pricing & license
The software is free under its Apache-2.0 licence, but it requires a connection to the Decionis API platform which determines operational costs.
Open remote AI-training roles
880 open remote AI-training roles, updated November 15, 2026; most pay $20–$175 an hour. Zekai lists them free; the application goes to the employer’s platform.
Alternatives
Use it, or have us set it up
FAQ
What happens if Decionis cannot be reached during a run?
A Decionis service that cannot be reached results in a refusal, and the command will not run.
How does shadow mode differ from enforcement?
Shadow mode starts the command immediately and records the verdict beside it without ever failing the build.
Can I use this with CI systems other than GitHub Actions?
Yes, the core gate is a Go binary that supports GitLab CI, Jenkins, and any other runner alongside GitHub Actions.
