Governed AI Agents

Deploy governed AI agent teams inside your organization. Every run is charter-enforced, fully audited, and independently verifiable.

What are Governed AI Agents?

Governed AI Agents is EVE's multi-agent execution platform for enterprises. It provides isolated workspaces where you deploy specialized AI agents, connect them to your existing tools, and trigger governed run sequences — all under EVE's deterministic charter enforcement.

Every action taken inside a workspace is evaluated against EVE's 12 immutable charter principles before execution. Run results are signed with Ed25519 certificates that your compliance team can verify independently, without calling back to EVE's servers.

Isolated Workspaces

Each workspace is tenant-scoped. Data, agents, and connectors never cross organizational boundaries.

Governed Runs

Charter enforcement runs on every execution before results are delivered. Blocked runs return a structured veto reason.

Immutable Audit Trail

All runs produce a hash-chained audit record. Tamper-evident and ready for regulatory review.

Signed Certificates

Each completed run generates a Governed Decision Certificate verifiable offline via the EVE Proof SDK.

Open Workforce Console

Creating Workspaces

A workspace is a named, isolated environment for a team or project. Agents, connectors, and run history are all scoped to the workspace. One organization can have multiple workspaces — for example, one per department or use case.

Open the Workforce Console

Navigate to Dashboard → Governed AI Agents. If this is your first visit, the sidebar will show an empty state with a prompt to create your first workspace.

Click "New Workspace"

Enter a descriptive name (e.g., Legal Review, Customer Support Automation, Research Pipeline). Names must be 2–80 characters. No special characters are required — plain English names work best.

Select the workspace

After creation, the workspace appears in the left sidebar. Click it to open the workspace detail view, where you can manage agents, connectors, runs, and compliance settings.

Tip: Keep workspace names specific to their purpose. You cannot rename a workspace after creation, but you can archive and replace it at any time. Archived workspaces and their full audit history remain accessible to administrators.

Archiving a Workspace

Hover over a workspace in the sidebar to reveal the archive button (🗑). Archiving hides the workspace from the active list but preserves all run history, audit records, and compliance data. Archived workspaces count against your plan's workspace limit until explicitly deleted by an administrator.

Deploying Agents

Agents are the workers inside your workspace. Each agent has a type that determines its capability profile — what it can do, which connectors it can access, and how it is governed. You can deploy multiple agents of the same or different types.

🔍

Researcher

Gathers information, synthesizes sources, produces structured summaries

📊

Analyst

Processes data, identifies patterns, generates insights and reports

⚡

Executor

Runs tasks, writes outputs to connectors, takes governed external actions

📡

Monitor

Watches for conditions, fires alerts, keeps watch on connected data streams

💬

Communicator

Drafts and sends messages, manages notifications, handles team outreach

Open the Agents tab

Inside your workspace, click the Agents tab in the top navigation bar.

Click "Deploy Agent"

Select the agent type from the dropdown, then click Deploy. The deployment is instantaneous — no provisioning wait time.

Confirm the agent appears

The new agent appears in the Agents tab with an active status badge and its assigned type. Agents are ready to participate in runs immediately after deployment.

Governance note: Each agent type is registered in EVE's Action Registry at deployment. Charter rules are evaluated against each agent's capability scope before any run is executed. An executor agent that attempts an action outside its approved scope will receive a BLOCKED verdict with a structured explanation.

Removing Agents

Click the Remove button next to any agent to decommission it. Removed agents no longer participate in new runs, but their history within past runs remains in the audit trail. This action is irreversible — deploy a new agent of the same type to replace it.

Adding Connectors

Connectors link your workspace to external systems. Agents use connectors to read data, deliver outputs, and take governed external actions. All connector interactions are logged in the run audit trail.

💬

Slack

slack

🎯

Jira

jira

🐙

GitHub

github

✉️

Email

🔗

Generic REST

generic_rest

Open the Connectors tab

Inside your workspace, click the Connectors tab.

Click "Add Connector"

Select the connector type (Slack, Jira, GitHub, Email, or Generic REST), enter a display name, and click Add. The name is used to identify the connector in run logs — choose something descriptive like Engineering Slack or Support Jira.

Configure credentials (optional)

Connector credentials (API keys, OAuth tokens, webhook URLs) are configured per-connector after creation. Navigate to the connector detail view to add authentication. Credentials are stored encrypted and never exposed in run logs or audit trails.

Generic REST: Use the generic_rest connector type to connect any HTTP/HTTPS endpoint not covered by named integrations. Provide the base URL and authentication headers in the connector settings. All outbound requests are proxied through EVE's governance gateway and are subject to charter enforcement.

Removing Connectors

Click Remove next to any connector in the Connectors tab. Removing a connector disables it for future runs. Historical run records that used the connector are unaffected. If an active run is referencing the connector at the time of removal, it will receive a connector-unavailable error on next use.

Triggering Runs

A run is a governed execution inside a workspace. Runs are orchestrated sequences of agent actions that flow through EVE's charter enforcement pipeline before any external outputs are produced.

Trigger Methods

Trigger	How to use	Best for
user	Click "Trigger Run" in the Runs tab and select Manual trigger	Ad-hoc tasks, testing, one-off workflows
schedule	Set a cron expression in run configuration	Recurring reports, daily monitoring, periodic audits
webhook	POST to the workspace webhook URL provided in Settings	Event-driven automation, CI/CD integration
api	Call `POST /api/workforce/spaces/{id}/runs` with your API key	Programmatic orchestration, custom integrations

Open the Runs tab

Inside your workspace, click the Runs tab. The table shows all past and in-progress runs with status, trigger type, duration, and governance verdict.

Click "Trigger Run"

Select trigger type Manual (user) and optionally add a run label for easy identification in audit logs. Click Start Run.

Monitor execution

The run row updates in real time as the run progresses. Click the run to see the full execution log including agent actions, connector calls, governance checks, and the final verdict.

Cancelling a Run

Runs with status pending or running can be cancelled from the Runs table. Click the Cancel button in the run row. Cancelled runs are recorded in the audit trail with a cancelled status and the timestamp of cancellation.

Note: Cancelling a run stops further agent actions, but any external outputs already delivered to connectors before cancellation are not reversed. If an executor agent has already written to Slack or Jira, those messages remain. Plan your run logic accordingly.

Compliance & Governance

The Compliance tab inside each workspace is your governance control panel. It shows charter enforcement metrics, signed audit certificates, policy override history, and governance health indicators in real time.

Governance Certificates

Every completed run — including runs that were blocked by the charter — generates a Governed Decision Certificate. Certificates are HMAC-SHA256 signed using EVE's trunk key and include:

Run ID and workspace ID
Timestamp and duration
Charter compliance verdict (ALLOWED / BLOCKED / MODIFIED)
List of charter rules evaluated
CRD (Confidence-Reality Divergence) score
HMAC-SHA256 signature for offline verification

Offline verification: Certificates can be verified without contacting EVE's servers using the EVE Proof SDK: pip install eve-proof. This is the recommended approach for compliance audits and regulatory reviews.

# Install the Proof SDK pip install eve-proof # Verify a certificate offline from eve_proof import verify_certificate result = verify_certificate(certificate_json) print(result['valid']) # True / False print(result['decision']) # ALLOWED / BLOCKED / MODIFIED print(result['charter_rules']) # List of rules evaluated

Charter Enforcement

EVE applies 12 immutable charter principles to every run. These cannot be disabled or weakened from the workspace settings. If a run triggers a charter violation, the run is blocked before any external outputs are produced, and a structured veto reason is included in the run log and certificate.

Enterprise plans can add custom charter rules that impose additional restrictions on top of the immutable set. Custom rules appear under Compliance → Custom Rules.

Audit Export

Export your full audit trail from the Compliance tab in CSV or JSON format. Exports include all run records, governance verdicts, and certificate IDs. Audit exports are useful for:

EU AI Act Article 12 logging obligations
SOC 2 Type II evidence collection
Internal compliance reviews
Incident investigation

Run Lifecycle

Every run moves through a defined set of statuses. Understanding the lifecycle helps you interpret run logs and build reliable integrations.

Status	Meaning	Cancellable?
pending	Run has been queued. Governance pre-checks are running. No agent actions have started.	Yes
running	Agents are actively executing. Connector calls may be in-flight.	Yes
completed	All agent actions finished and passed governance review. Certificate generated.	No
failed	Run encountered an unrecoverable error. Partial results may exist. Certificate generated with failure record.	No
blocked	Charter enforcement vetoed the run before or during execution. No external outputs were produced. Certificate generated with veto details.	No
cancelled	Run was manually cancelled. Partial work may have been done before cancellation.	No

Tip: Blocked runs are not failures — they are the governance layer working as designed. Review the veto details in the run log to understand which charter rule fired and adjust your run configuration accordingly.

Plan Quotas

Governed AI Agents usage is metered by runs executed per month. When you approach your limit, a warning appears in the workspace header. When the limit is reached, new runs return a quota error until the next billing cycle or until you upgrade.

Feature	Free	Pro	Team	Enterprise
Workspaces	1	5	20	Unlimited
Agents per workspace	2	10	25	Unlimited
Connectors per workspace	1	5	15	Unlimited
Runs per month	10	500	2,500	Unlimited
Governance certificates	✓	✓	✓	✓
Custom charter rules	—	—	5 rules	Unlimited
Audit export	—	✓ (90 days)	✓ (1 year)	✓ (7 years)
Webhook triggers	—	✓	✓	✓
API triggers	—	✓	✓	✓

Overage handling: When your run quota is exhausted, new run requests return HTTP 429. Runs in progress at quota exhaustion are allowed to complete. Upgrade at any time from Dashboard → Billing.

API Reference

All Governed AI Agents operations are available via REST API. Authenticate with a Bearer token from Dashboard → API Keys. All endpoints are prefixed with /api/workforce/spaces.

Workspace Endpoints

# List all workspaces for your organization GET /api/workforce/spaces # Create a new workspace POST /api/workforce/spaces # Body: { "name": "My Workspace" } # Get a workspace GET /api/workforce/spaces/{space_id} # Archive (soft-delete) a workspace DELETE /api/workforce/spaces/{space_id}

Agent Endpoints

# List agents in a workspace GET /api/workforce/spaces/{space_id}/agents # Deploy a new agent POST /api/workforce/spaces/{space_id}/agents # Body: { "agent_type": "researcher" | "analyst" | "executor" | "monitor" | "communicator", # "name": "My Agent" } # Remove an agent DELETE /api/workforce/spaces/{space_id}/agents/{agent_id}

Connector Endpoints

# List connectors in a workspace GET /api/workforce/spaces/{space_id}/connectors # Add a connector POST /api/workforce/spaces/{space_id}/connectors # Body: { "connector_type": "slack" | "jira" | "github" | "email" | "generic_rest", # "name": "Engineering Slack" } # Remove a connector DELETE /api/workforce/spaces/{space_id}/connectors/{connector_id}

Run Endpoints

# List runs in a workspace GET /api/workforce/spaces/{space_id}/runs # Trigger a new run POST /api/workforce/spaces/{space_id}/runs # Body: { "trigger": "user" | "schedule" | "webhook" | "api", # "label": "Weekly Report" } # Get run details GET /api/workforce/spaces/{space_id}/runs/{run_id} # Cancel a pending or running run POST /api/workforce/spaces/{space_id}/runs/{run_id}/cancel

Authentication: Include your API key as a Bearer token: Authorization: Bearer eve_sk_.... Keys are created in Dashboard → Developer → API Keys and scoped to your organization.