> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usechar.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Governance

> BYO governance integrations for policy enforcement, approvals, and audit outcomes

<Note>
  **Private Beta** — [Contact us](mailto:alex@mcp-b.ai?subject=Enterprise%20Governance) to get set up.
</Note>

Some deployments need more than tool access—they need controls. Who can use which tools, from where, under what conditions. What gets inspected. What requires approval. What gets logged.

Char is provider-agnostic. You plug in your governance platform (LangGuard or BYO interceptor), and Char enforces its decisions uniformly across embedded agents, remote MCP servers, the browser extension, and autonomous execution.

## Authority model

* **Identity provider (IdP)** is authoritative for identity, groups, and roles.
* **Governance provider** is authoritative for tool policy decisions (`success`, `notify`, `failure`).
* **Char UI hints** are informational only and are not enterprise enforcement controls.
* **No managed policy engine** is required from Char for custom governance logic.

## Decision flow

Every tool call flows through multiple layers:

```mermaid theme={null}
graph TD
    subgraph "Identity"
        A[IdP Identity] --> B[Role / Group Claims]
        B --> C[App/Origin Constraints]
    end

    subgraph "Policy Provider"
        D[PDP Interceptor]
    end

    subgraph "Approval"
        E{Risk Class} --> F[Auto / Role / Explicit]
    end

    C --> D
    D --> E
    F --> G[Execute or Block]
    G --> H[Audit Log]
```

**Identity context** determines who is calling and what role context is attached.

**Policy provider** evaluates content and context—is there PII in the arguments, does this look like prompt injection, does it violate org policies.

**Approval** checks the risk classification—read-only operations auto-approve, destructive operations require explicit sign-off.

**Audit** logs everything—who did what, when, with what arguments, what the result was.

## In this section

<CardGroup cols={2}>
  <Card title="Integrations" icon="plug" href="/guides/governance/integrations">
    LangGuard or bring your own policy provider
  </Card>

  <Card title="Policy Decision Point" icon="gavel" href="/guides/governance/policy-decision-point">
    Interceptor-based policy checks for MCP calls
  </Card>
</CardGroup>