pi-governanceControl Your Coding Agent

Your coding agent has access to your terminal, filesystem, and secrets. Control what it can do.

Agents Run Any Bash Command

Without controls, your agent can execute rm -rf, curl to external servers, or install malicious packages. pi-governance classifies every command and blocks dangerous ones automatically.

Agents Read Your Files

Your .env files, API keys, and private keys flow through tool calls to LLM providers. DLP scanning blocks secrets on input and masks PII in output — before they leave your machine.

No Audit Trail

Who ran what, when, and why? Without logging, you can't answer. pi-governance logs every tool call as structured JSON with user, role, decision, and reason.

Role-Based Controls

Define who can do what. Analysts get read-only access. Project leads need approval for writes. Admins run autonomously. Each role has scoped tools, paths, and budgets.

Automatic DLP

15+ secret patterns and 5+ PII patterns detected out of the box. Block API keys in tool inputs, mask credit cards in outputs. Add custom patterns for your organization.

Zero-Config Start

Install and go. One command gives you bash blocking, DLP, supervised mode, and audit logging. Customize when you're ready with YAML or the interactive wizard.

Install

Pi extension

bash

pi install npm:@grwnd/pi-governance

OpenClaw plugin