Start with where your workflow's credentials will be held. The supported customer path keeps them in your vault; AAES Govern fetches them to make a permitted call. If the agent keeps its own credential, AAES Govern can record reported activity but cannot stop it. The table also identifies lab-only and unavailable options.
Custody means who holds and can use a credential. An enforcement label describes the configured access path. It does not establish that the deployment has removed every bypass.
These pages describe the product. They are not a certification or a legal opinion.
How to read the labels
- Enforced: the configured custody model has a connected path that can enforce the decision. Deployment testing must still establish that the agent cannot bypass it.
- Observed: the actor holds its own credential. AAES Govern records reported activity and cannot prevent the call; pass-through registrations always carry this label.
- Inventory: the registration does not identify an enforcing or observed path, including a wildcard scope.
How the software assigns a label
One function computes the label from the custody model and configured connections, and every surface shows that result. No surface recomputes it. A model intended to enforce but missing its connection maps defensively to inventory; the daemon refuses to start in that configuration, so a running system cannot reach it.
The matrix
| Custody model | Who holds the credential at use | Enforcement label | Build status |
|---|---|---|---|
customer_vault | The client's secret manager; AAES Govern holds a reference and fetches at the moment of use. | Enforced when wired. | Implemented: the enforcing path. Served only when -custody-sources configures a vault connection; a capability that declares it without one is refused at startup, naming what is missing. Brokered execution via POST /v1/brokered. |
inline | AAES, in its encrypted store (AES-256-GCM under a local master key). | Enforced when wired. | Implemented; lab-only. The daemon refuses to start with an inline capability unless -allow-inline-custody is passed. Demonstrated in the evaluation demos; not a supported customer deployment path. |
pass_through | The actor holds its own credential. | Observed, always. Never labeled enforced. | Implemented. The connector gate refuses to execute a pass-through capability; the actor's outcome report is recorded as the actor's claim, excluded from the coverage numerator. An actor that acts without asking leaves no AAES Govern trace. |
identity_federation | The client's identity provider, by token exchange. | Would be enforced when wired; today a registration is refused. | Designed; refused at startup. No token issuer is wired, so the per-decision token cannot be minted. Not a supported customer deployment default. |
customer_broker | The client's own broker, inside the client's deployment. | Would be enforced when wired; today a registration is refused. | Designed; refused at startup. No client-hosted broker client is wired. Not a supported customer deployment default. |
Model calls and MCP tool calls use the same custody models. A model source behind Govern’s model gateway is registered as an HTTP capability whose provider key is held in the customer vault, or in inline custody where the daemon allows it; the agent holds only a Govern-issued gateway token. Each tool exposed through Govern’s MCP endpoint maps to a registered capability and carries that capability’s label.
The matrix was reviewed against the local implementation on October 3, 2026. Automated site tests check its claims against the daemon configuration code and custody resolvers in the evaluation repository. The two implemented enforcing models are tested; the two unavailable models are tested for startup refusal. A capability whose declared model this build does not serve never reaches a governed call.
Limits
- The label describes the configured path. Activity outside the governed path is visible only where telemetry is supplied.
- Enforced depends on deployment. A registration an operator writes is a claim; the wiring check happens at startup, and the bypass question stays open at the client's firewall.
- This matrix ages. The review date above is the claim. The site test suite refuses a matrix whose statements no longer match the wiring.
Use an evaluation to check where your workflow's credentials are held and whether the agent can bypass AAES Govern.