Govern

Govern is where you watch the boundary do its job on real traffic — the decisions it made, the receipts it produced, and the posture it’s in. It’s the evidence that lets you keep an agent on a consequential action and still answer “what happened, and why?” — the on-screen view of the same records a proof pack exports.

What this does

For one Protected Control over a time window, Govern shows, summary-first:

• Control identity — the action, entity type, environment, and current mode.
• Posture — whether the control is in shadow or enforce, and when that last changed.
• Decisions by outcome — counts of allowed, blocked, approval_required, invalid, with a drill-down into individual decisions.
• Receipts — the signed records, with their signature and verifiability status.
• Completeness — whether the window shown is complete or truncated, so a partial view never reads as the whole story.

It reads top-down: a one-line summary of the control’s state, then detail on demand.

Shadow vs enforce

A control runs in one of two postures, and Govern is honest about which:

• shadow (observe-only) — KIFF evaluates every action and records what it would have decided, but does not withhold anything; your runtime proceeds as usual. This is the on-ramp: watch real decisions on real traffic before you turn the gate on.
• enforce — KIFF’s decision is acted on: allowed runs, everything else is withheld by your runtime.

Shadow always reads as would-have-decided, never as production enforcement. The point of shadow is to build trust before you flip to enforce, and the moment you flipped is itself recorded.

Honest by design

Govern is built to state what it can and cannot show. Every section renders a distinct recorded, empty, or not-yet-recorded state rather than implying completeness:

• A control with no traffic yet shows an honest empty state, not a staged success.
• A section whose data isn’t recorded yet says so plainly.
• Verifiability is scope-aware — a sampled result never presents itself as a complete-window guarantee.

This matters because most dashboards imply more than they know. Govern’s value depends on the opposite: if it says something happened, it happened, and if it can’t show something, it says so.

What it does not show

• It does not show that an action executed downstream — only what KIFF decided. KIFF is the decision boundary, not the runner.
• It does not present demo or synthetic data as real customer evidence.
• It does not claim reviewer attribution the product doesn’t record yet (see What’s real today).

The Govern view for a control with real traffic — the summary line and decisions by outcome, from a clean demo tenant.

The honest empty state — a control installed and waiting, before any real proposal has run. KIFF never stages evidence that does not exist.

Next

• What the receipts here prove → Receipts & proof packs.
• The full honesty line → What’s real today.