Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Thoth
  4. API Docs
  5. governance
  6. GovernanceSettings
Viewing docs for Thoth v0.1.22
published on Sunday, Oct 25, 2026 by Aten Security
Schema (JSON)
atensecurity/pulumi-thoth

thoth.governance.GovernanceSettings

thoth logo Thoth
Viewing docs for Thoth v0.1.22
published on Sunday, Oct 25, 2026 by Aten Security
Schema (JSON)
atensecurity/pulumi-thoth

    Create GovernanceSettings Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new GovernanceSettings(name: string, args?: GovernanceSettingsArgs, opts?: CustomResourceOptions);
    @overload
def GovernanceSettings(resource_name: str,
                       args: Optional[GovernanceSettingsArgs] = None,
                       opts: Optional[ResourceOptions] = None)

@overload
def GovernanceSettings(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       compliance_enforcement_mode: Optional[str] = None,
                       compliance_profile: Optional[str] = None,
                       declared_regulatory_regimes: Optional[Sequence[str]] = None,
                       extra_settings_json: Optional[str] = None,
                       model_router_allowed_models: Optional[Sequence[str]] = None,
                       model_router_allowed_providers: Optional[Sequence[str]] = None,
                       model_router_default_model: Optional[str] = None,
                       model_router_default_provider: Optional[str] = None,
                       model_router_enabled: Optional[bool] = None,
                       model_router_failover_providers: Optional[Sequence[str]] = None,
                       regulatory_regimes: Optional[Sequence[str]] = None,
                       secret_broker_allowed_hosts: Optional[Sequence[str]] = None,
                       secret_broker_auth_bindings_json: Optional[str] = None,
                       secret_broker_enabled: Optional[bool] = None,
                       secret_broker_fail_on_missing_secret: Optional[bool] = None,
                       secret_broker_provider: Optional[str] = None,
                       secret_broker_strict_endpoint_mode: Optional[bool] = None,
                       shadow_critical: Optional[str] = None,
                       shadow_high: Optional[str] = None,
                       shadow_low: Optional[str] = None,
                       shadow_medium: Optional[str] = None,
                       tool_risk_overrides: Optional[Mapping[str, str]] = None)
    func NewGovernanceSettings(ctx *Context, name string, args *GovernanceSettingsArgs, opts ...ResourceOption) (*GovernanceSettings, error)
    public GovernanceSettings(string name, GovernanceSettingsArgs? args = null, CustomResourceOptions? opts = null)
    public GovernanceSettings(String name, GovernanceSettingsArgs args)
public GovernanceSettings(String name, GovernanceSettingsArgs args, CustomResourceOptions options)

    type: thoth:governance:GovernanceSettings
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "thoth_governance_governance_settings" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args GovernanceSettingsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args GovernanceSettingsArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args GovernanceSettingsArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args GovernanceSettingsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args GovernanceSettingsArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var governanceSettingsResource = new Thoth.Governance.GovernanceSettings("governanceSettingsResource", new()
{
    ComplianceEnforcementMode = "string",
    ComplianceProfile = "string",
    DeclaredRegulatoryRegimes = new[]
    {
        "string",
    },
    ExtraSettingsJson = "string",
    ModelRouterAllowedModels = new[]
    {
        "string",
    },
    ModelRouterAllowedProviders = new[]
    {
        "string",
    },
    ModelRouterDefaultModel = "string",
    ModelRouterDefaultProvider = "string",
    ModelRouterEnabled = false,
    ModelRouterFailoverProviders = new[]
    {
        "string",
    },
    RegulatoryRegimes = new[]
    {
        "string",
    },
    SecretBrokerAllowedHosts = new[]
    {
        "string",
    },
    SecretBrokerAuthBindingsJson = "string",
    SecretBrokerEnabled = false,
    SecretBrokerFailOnMissingSecret = false,
    SecretBrokerProvider = "string",
    SecretBrokerStrictEndpointMode = false,
    ShadowCritical = "string",
    ShadowHigh = "string",
    ShadowLow = "string",
    ShadowMedium = "string",
    ToolRiskOverrides = 
    {
        { "string", "string" },
    },
});

    example, err := governance.NewGovernanceSettings(ctx, "governanceSettingsResource", &governance.GovernanceSettingsArgs{
	ComplianceEnforcementMode: pulumi.String("string"),
	ComplianceProfile:         pulumi.String("string"),
	DeclaredRegulatoryRegimes: pulumi.StringArray{
		pulumi.String("string"),
	},
	ExtraSettingsJson: pulumi.String("string"),
	ModelRouterAllowedModels: pulumi.StringArray{
		pulumi.String("string"),
	},
	ModelRouterAllowedProviders: pulumi.StringArray{
		pulumi.String("string"),
	},
	ModelRouterDefaultModel:    pulumi.String("string"),
	ModelRouterDefaultProvider: pulumi.String("string"),
	ModelRouterEnabled:         pulumi.Bool(false),
	ModelRouterFailoverProviders: pulumi.StringArray{
		pulumi.String("string"),
	},
	RegulatoryRegimes: pulumi.StringArray{
		pulumi.String("string"),
	},
	SecretBrokerAllowedHosts: pulumi.StringArray{
		pulumi.String("string"),
	},
	SecretBrokerAuthBindingsJson:    pulumi.String("string"),
	SecretBrokerEnabled:             pulumi.Bool(false),
	SecretBrokerFailOnMissingSecret: pulumi.Bool(false),
	SecretBrokerProvider:            pulumi.String("string"),
	SecretBrokerStrictEndpointMode:  pulumi.Bool(false),
	ShadowCritical:                  pulumi.String("string"),
	ShadowHigh:                      pulumi.String("string"),
	ShadowLow:                       pulumi.String("string"),
	ShadowMedium:                    pulumi.String("string"),
	ToolRiskOverrides: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
})

    resource "thoth_governance_governance_settings" "governanceSettingsResource" {
  lifecycle {
    create_before_destroy = true
  }
  compliance_enforcement_mode          = "string"
  compliance_profile                   = "string"
  declared_regulatory_regimes          = ["string"]
  extra_settings_json                  = "string"
  model_router_allowed_models          = ["string"]
  model_router_allowed_providers       = ["string"]
  model_router_default_model           = "string"
  model_router_default_provider        = "string"
  model_router_enabled                 = false
  model_router_failover_providers      = ["string"]
  regulatory_regimes                   = ["string"]
  secret_broker_allowed_hosts          = ["string"]
  secret_broker_auth_bindings_json     = "string"
  secret_broker_enabled                = false
  secret_broker_fail_on_missing_secret = false
  secret_broker_provider               = "string"
  secret_broker_strict_endpoint_mode   = false
  shadow_critical                      = "string"
  shadow_high                          = "string"
  shadow_low                           = "string"
  shadow_medium                        = "string"
  tool_risk_overrides = {
    "string" = "string"
  }
}

    var governanceSettingsResource = new GovernanceSettings("governanceSettingsResource", GovernanceSettingsArgs.builder()
    .complianceEnforcementMode("string")
    .complianceProfile("string")
    .declaredRegulatoryRegimes("string")
    .extraSettingsJson("string")
    .modelRouterAllowedModels("string")
    .modelRouterAllowedProviders("string")
    .modelRouterDefaultModel("string")
    .modelRouterDefaultProvider("string")
    .modelRouterEnabled(false)
    .modelRouterFailoverProviders("string")
    .regulatoryRegimes("string")
    .secretBrokerAllowedHosts("string")
    .secretBrokerAuthBindingsJson("string")
    .secretBrokerEnabled(false)
    .secretBrokerFailOnMissingSecret(false)
    .secretBrokerProvider("string")
    .secretBrokerStrictEndpointMode(false)
    .shadowCritical("string")
    .shadowHigh("string")
    .shadowLow("string")
    .shadowMedium("string")
    .toolRiskOverrides(Map.of("string", "string"))
    .build());

    governance_settings_resource = thoth.governance.GovernanceSettings("governanceSettingsResource",
    compliance_enforcement_mode="string",
    compliance_profile="string",
    declared_regulatory_regimes=["string"],
    extra_settings_json="string",
    model_router_allowed_models=["string"],
    model_router_allowed_providers=["string"],
    model_router_default_model="string",
    model_router_default_provider="string",
    model_router_enabled=False,
    model_router_failover_providers=["string"],
    regulatory_regimes=["string"],
    secret_broker_allowed_hosts=["string"],
    secret_broker_auth_bindings_json="string",
    secret_broker_enabled=False,
    secret_broker_fail_on_missing_secret=False,
    secret_broker_provider="string",
    secret_broker_strict_endpoint_mode=False,
    shadow_critical="string",
    shadow_high="string",
    shadow_low="string",
    shadow_medium="string",
    tool_risk_overrides={
        "string": "string",
    })

    const governanceSettingsResource = new thoth.governance.GovernanceSettings("governanceSettingsResource", {
    complianceEnforcementMode: "string",
    complianceProfile: "string",
    declaredRegulatoryRegimes: ["string"],
    extraSettingsJson: "string",
    modelRouterAllowedModels: ["string"],
    modelRouterAllowedProviders: ["string"],
    modelRouterDefaultModel: "string",
    modelRouterDefaultProvider: "string",
    modelRouterEnabled: false,
    modelRouterFailoverProviders: ["string"],
    regulatoryRegimes: ["string"],
    secretBrokerAllowedHosts: ["string"],
    secretBrokerAuthBindingsJson: "string",
    secretBrokerEnabled: false,
    secretBrokerFailOnMissingSecret: false,
    secretBrokerProvider: "string",
    secretBrokerStrictEndpointMode: false,
    shadowCritical: "string",
    shadowHigh: "string",
    shadowLow: "string",
    shadowMedium: "string",
    toolRiskOverrides: {
        string: "string",
    },
});

    type: thoth:governance:GovernanceSettings
properties:
    complianceEnforcementMode: string
    complianceProfile: string
    declaredRegulatoryRegimes:
        - string
    extraSettingsJson: string
    modelRouterAllowedModels:
        - string
    modelRouterAllowedProviders:
        - string
    modelRouterDefaultModel: string
    modelRouterDefaultProvider: string
    modelRouterEnabled: false
    modelRouterFailoverProviders:
        - string
    regulatoryRegimes:
        - string
    secretBrokerAllowedHosts:
        - string
    secretBrokerAuthBindingsJson: string
    secretBrokerEnabled: false
    secretBrokerFailOnMissingSecret: false
    secretBrokerProvider: string
    secretBrokerStrictEndpointMode: false
    shadowCritical: string
    shadowHigh: string
    shadowLow: string
    shadowMedium: string
    toolRiskOverrides:
        string: string

    GovernanceSettings Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The GovernanceSettings resource accepts the following input properties:

    ComplianceEnforcementMode string
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    ComplianceProfile string
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    DeclaredRegulatoryRegimes List<string>
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    ExtraSettingsJson string
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    ModelRouterAllowedModels List<string>
    Allowed model names allowlist.
    ModelRouterAllowedProviders List<string>
    Allowed model providers allowlist.
    ModelRouterDefaultModel string
    Default model name.
    ModelRouterDefaultProvider string
    Default model provider.
    ModelRouterEnabled bool
    Enable model routing policy controls.
    ModelRouterFailoverProviders List<string>
    Failover provider order.
    RegulatoryRegimes List<string>
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    SecretBrokerAllowedHosts List<string>
    Allowed host patterns for secret broker.
    SecretBrokerAuthBindingsJson string
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    SecretBrokerEnabled bool
    Enable secret broker policy enforcement.
    SecretBrokerFailOnMissingSecret bool
    Fail governed calls when referenced secret is unavailable.
    SecretBrokerProvider string
    Secret broker provider slug.
    SecretBrokerStrictEndpointMode bool
    Require endpoint registration for secret resolution.
    ShadowCritical string
    Default action for critical risk events.
    ShadowHigh string
    Default action for high risk events.
    ShadowLow string
    Default action for low risk events.
    ShadowMedium string
    Default action for medium risk events.
    ToolRiskOverrides Dictionary<string, string>
    Tool-specific risk tier overrides.
    ComplianceEnforcementMode string
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    ComplianceProfile string
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    DeclaredRegulatoryRegimes []string
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    ExtraSettingsJson string
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    ModelRouterAllowedModels []string
    Allowed model names allowlist.
    ModelRouterAllowedProviders []string
    Allowed model providers allowlist.
    ModelRouterDefaultModel string
    Default model name.
    ModelRouterDefaultProvider string
    Default model provider.
    ModelRouterEnabled bool
    Enable model routing policy controls.
    ModelRouterFailoverProviders []string
    Failover provider order.
    RegulatoryRegimes []string
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    SecretBrokerAllowedHosts []string
    Allowed host patterns for secret broker.
    SecretBrokerAuthBindingsJson string
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    SecretBrokerEnabled bool
    Enable secret broker policy enforcement.
    SecretBrokerFailOnMissingSecret bool
    Fail governed calls when referenced secret is unavailable.
    SecretBrokerProvider string
    Secret broker provider slug.
    SecretBrokerStrictEndpointMode bool
    Require endpoint registration for secret resolution.
    ShadowCritical string
    Default action for critical risk events.
    ShadowHigh string
    Default action for high risk events.
    ShadowLow string
    Default action for low risk events.
    ShadowMedium string
    Default action for medium risk events.
    ToolRiskOverrides map[string]string
    Tool-specific risk tier overrides.
    compliance_enforcement_mode string
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    compliance_profile string
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    declared_regulatory_regimes list(string)
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    extra_settings_json string
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    model_router_allowed_models list(string)
    Allowed model names allowlist.
    model_router_allowed_providers list(string)
    Allowed model providers allowlist.
    model_router_default_model string
    Default model name.
    model_router_default_provider string
    Default model provider.
    model_router_enabled bool
    Enable model routing policy controls.
    model_router_failover_providers list(string)
    Failover provider order.
    regulatory_regimes list(string)
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    secret_broker_allowed_hosts list(string)
    Allowed host patterns for secret broker.
    secret_broker_auth_bindings_json string
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    secret_broker_enabled bool
    Enable secret broker policy enforcement.
    secret_broker_fail_on_missing_secret bool
    Fail governed calls when referenced secret is unavailable.
    secret_broker_provider string
    Secret broker provider slug.
    secret_broker_strict_endpoint_mode bool
    Require endpoint registration for secret resolution.
    shadow_critical string
    Default action for critical risk events.
    shadow_high string
    Default action for high risk events.
    shadow_low string
    Default action for low risk events.
    shadow_medium string
    Default action for medium risk events.
    tool_risk_overrides map(string)
    Tool-specific risk tier overrides.
    complianceEnforcementMode String
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    complianceProfile String
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    declaredRegulatoryRegimes List<String>
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    extraSettingsJson String
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    modelRouterAllowedModels List<String>
    Allowed model names allowlist.
    modelRouterAllowedProviders List<String>
    Allowed model providers allowlist.
    modelRouterDefaultModel String
    Default model name.
    modelRouterDefaultProvider String
    Default model provider.
    modelRouterEnabled Boolean
    Enable model routing policy controls.
    modelRouterFailoverProviders List<String>
    Failover provider order.
    regulatoryRegimes List<String>
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    secretBrokerAllowedHosts List<String>
    Allowed host patterns for secret broker.
    secretBrokerAuthBindingsJson String
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    secretBrokerEnabled Boolean
    Enable secret broker policy enforcement.
    secretBrokerFailOnMissingSecret Boolean
    Fail governed calls when referenced secret is unavailable.
    secretBrokerProvider String
    Secret broker provider slug.
    secretBrokerStrictEndpointMode Boolean
    Require endpoint registration for secret resolution.
    shadowCritical String
    Default action for critical risk events.
    shadowHigh String
    Default action for high risk events.
    shadowLow String
    Default action for low risk events.
    shadowMedium String
    Default action for medium risk events.
    toolRiskOverrides Map<String,String>
    Tool-specific risk tier overrides.
    complianceEnforcementMode string
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    complianceProfile string
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    declaredRegulatoryRegimes string[]
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    extraSettingsJson string
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    modelRouterAllowedModels string[]
    Allowed model names allowlist.
    modelRouterAllowedProviders string[]
    Allowed model providers allowlist.
    modelRouterDefaultModel string
    Default model name.
    modelRouterDefaultProvider string
    Default model provider.
    modelRouterEnabled boolean
    Enable model routing policy controls.
    modelRouterFailoverProviders string[]
    Failover provider order.
    regulatoryRegimes string[]
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    secretBrokerAllowedHosts string[]
    Allowed host patterns for secret broker.
    secretBrokerAuthBindingsJson string
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    secretBrokerEnabled boolean
    Enable secret broker policy enforcement.
    secretBrokerFailOnMissingSecret boolean
    Fail governed calls when referenced secret is unavailable.
    secretBrokerProvider string
    Secret broker provider slug.
    secretBrokerStrictEndpointMode boolean
    Require endpoint registration for secret resolution.
    shadowCritical string
    Default action for critical risk events.
    shadowHigh string
    Default action for high risk events.
    shadowLow string
    Default action for low risk events.
    shadowMedium string
    Default action for medium risk events.
    toolRiskOverrides {[key: string]: string}
    Tool-specific risk tier overrides.
    compliance_enforcement_mode str
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    compliance_profile str
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    declared_regulatory_regimes Sequence[str]
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    extra_settings_json str
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    model_router_allowed_models Sequence[str]
    Allowed model names allowlist.
    model_router_allowed_providers Sequence[str]
    Allowed model providers allowlist.
    model_router_default_model str
    Default model name.
    model_router_default_provider str
    Default model provider.
    model_router_enabled bool
    Enable model routing policy controls.
    model_router_failover_providers Sequence[str]
    Failover provider order.
    regulatory_regimes Sequence[str]
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    secret_broker_allowed_hosts Sequence[str]
    Allowed host patterns for secret broker.
    secret_broker_auth_bindings_json str
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    secret_broker_enabled bool
    Enable secret broker policy enforcement.
    secret_broker_fail_on_missing_secret bool
    Fail governed calls when referenced secret is unavailable.
    secret_broker_provider str
    Secret broker provider slug.
    secret_broker_strict_endpoint_mode bool
    Require endpoint registration for secret resolution.
    shadow_critical str
    Default action for critical risk events.
    shadow_high str
    Default action for high risk events.
    shadow_low str
    Default action for low risk events.
    shadow_medium str
    Default action for medium risk events.
    tool_risk_overrides Mapping[str, str]
    Tool-specific risk tier overrides.
    complianceEnforcementMode String
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    complianceProfile String
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    declaredRegulatoryRegimes List<String>
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    extraSettingsJson String
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    modelRouterAllowedModels List<String>
    Allowed model names allowlist.
    modelRouterAllowedProviders List<String>
    Allowed model providers allowlist.
    modelRouterDefaultModel String
    Default model name.
    modelRouterDefaultProvider String
    Default model provider.
    modelRouterEnabled Boolean
    Enable model routing policy controls.
    modelRouterFailoverProviders List<String>
    Failover provider order.
    regulatoryRegimes List<String>
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    secretBrokerAllowedHosts List<String>
    Allowed host patterns for secret broker.
    secretBrokerAuthBindingsJson String
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    secretBrokerEnabled Boolean
    Enable secret broker policy enforcement.
    secretBrokerFailOnMissingSecret Boolean
    Fail governed calls when referenced secret is unavailable.
    secretBrokerProvider String
    Secret broker provider slug.
    secretBrokerStrictEndpointMode Boolean
    Require endpoint registration for secret resolution.
    shadowCritical String
    Default action for critical risk events.
    shadowHigh String
    Default action for high risk events.
    shadowLow String
    Default action for low risk events.
    shadowMedium String
    Default action for medium risk events.
    toolRiskOverrides Map<String>
    Tool-specific risk tier overrides.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the GovernanceSettings resource produces the following output properties:

    CanonicalRegimes List<string>
    Canonical declared regimes. Known during planning for known declarations.
    ComplianceCatalogueSha256 string
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    ComplianceCoverage Dictionary<string, AtenSecurity.GovernanceSettingsComplianceCoverage>
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    ComplianceEvaluatorSha256 string
    Pinned evaluator identity, checked before mutation.
    ComplianceRevision int
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    Id string
    The provider-assigned unique ID for this managed resource.
    PropagationMaxMs int
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    RegimesWithoutControls List<string>
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    TenantId string
    Tenant ID resolved from provider configuration.
    UpdatedAt string
    Last update timestamp returned by GovAPI.
    CanonicalRegimes []string
    Canonical declared regimes. Known during planning for known declarations.
    ComplianceCatalogueSha256 string
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    ComplianceCoverage map[string]GovernanceSettingsComplianceCoverage
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    ComplianceEvaluatorSha256 string
    Pinned evaluator identity, checked before mutation.
    ComplianceRevision int
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    Id string
    The provider-assigned unique ID for this managed resource.
    PropagationMaxMs int
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    RegimesWithoutControls []string
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    TenantId string
    Tenant ID resolved from provider configuration.
    UpdatedAt string
    Last update timestamp returned by GovAPI.
    canonical_regimes list(string)
    Canonical declared regimes. Known during planning for known declarations.
    compliance_catalogue_sha256 string
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    compliance_coverage map(object)
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    compliance_evaluator_sha256 string
    Pinned evaluator identity, checked before mutation.
    compliance_revision number
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    id string
    The provider-assigned unique ID for this managed resource.
    propagation_max_ms number
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    regimes_without_controls list(string)
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    tenant_id string
    Tenant ID resolved from provider configuration.
    updated_at string
    Last update timestamp returned by GovAPI.
    canonicalRegimes List<String>
    Canonical declared regimes. Known during planning for known declarations.
    complianceCatalogueSha256 String
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    complianceCoverage Map<String,GovernanceSettingsComplianceCoverage>
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    complianceEvaluatorSha256 String
    Pinned evaluator identity, checked before mutation.
    complianceRevision Integer
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    id String
    The provider-assigned unique ID for this managed resource.
    propagationMaxMs Integer
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    regimesWithoutControls List<String>
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    tenantId String
    Tenant ID resolved from provider configuration.
    updatedAt String
    Last update timestamp returned by GovAPI.
    canonicalRegimes string[]
    Canonical declared regimes. Known during planning for known declarations.
    complianceCatalogueSha256 string
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    complianceCoverage {[key: string]: GovernanceSettingsComplianceCoverage}
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    complianceEvaluatorSha256 string
    Pinned evaluator identity, checked before mutation.
    complianceRevision number
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    id string
    The provider-assigned unique ID for this managed resource.
    propagationMaxMs number
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    regimesWithoutControls string[]
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    tenantId string
    Tenant ID resolved from provider configuration.
    updatedAt string
    Last update timestamp returned by GovAPI.
    canonical_regimes Sequence[str]
    Canonical declared regimes. Known during planning for known declarations.
    compliance_catalogue_sha256 str
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    compliance_coverage Mapping[str, GovernanceSettingsComplianceCoverage]
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    compliance_evaluator_sha256 str
    Pinned evaluator identity, checked before mutation.
    compliance_revision int
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    id str
    The provider-assigned unique ID for this managed resource.
    propagation_max_ms int
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    regimes_without_controls Sequence[str]
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    tenant_id str
    Tenant ID resolved from provider configuration.
    updated_at str
    Last update timestamp returned by GovAPI.
    canonicalRegimes List<String>
    Canonical declared regimes. Known during planning for known declarations.
    complianceCatalogueSha256 String
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    complianceCoverage Map<Property Map>
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    complianceEvaluatorSha256 String
    Pinned evaluator identity, checked before mutation.
    complianceRevision Number
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    id String
    The provider-assigned unique ID for this managed resource.
    propagationMaxMs Number
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    regimesWithoutControls List<String>
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    tenantId String
    Tenant ID resolved from provider configuration.
    updatedAt String
    Last update timestamp returned by GovAPI.

    Look up Existing GovernanceSettings Resource

    Get an existing GovernanceSettings resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: GovernanceSettingsState, opts?: CustomResourceOptions): GovernanceSettings
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        canonical_regimes: Optional[Sequence[str]] = None,
        compliance_catalogue_sha256: Optional[str] = None,
        compliance_coverage: Optional[Mapping[str, GovernanceSettingsComplianceCoverageArgs]] = None,
        compliance_enforcement_mode: Optional[str] = None,
        compliance_evaluator_sha256: Optional[str] = None,
        compliance_profile: Optional[str] = None,
        compliance_revision: Optional[int] = None,
        declared_regulatory_regimes: Optional[Sequence[str]] = None,
        extra_settings_json: Optional[str] = None,
        model_router_allowed_models: Optional[Sequence[str]] = None,
        model_router_allowed_providers: Optional[Sequence[str]] = None,
        model_router_default_model: Optional[str] = None,
        model_router_default_provider: Optional[str] = None,
        model_router_enabled: Optional[bool] = None,
        model_router_failover_providers: Optional[Sequence[str]] = None,
        propagation_max_ms: Optional[int] = None,
        regimes_without_controls: Optional[Sequence[str]] = None,
        regulatory_regimes: Optional[Sequence[str]] = None,
        secret_broker_allowed_hosts: Optional[Sequence[str]] = None,
        secret_broker_auth_bindings_json: Optional[str] = None,
        secret_broker_enabled: Optional[bool] = None,
        secret_broker_fail_on_missing_secret: Optional[bool] = None,
        secret_broker_provider: Optional[str] = None,
        secret_broker_strict_endpoint_mode: Optional[bool] = None,
        shadow_critical: Optional[str] = None,
        shadow_high: Optional[str] = None,
        shadow_low: Optional[str] = None,
        shadow_medium: Optional[str] = None,
        tenant_id: Optional[str] = None,
        tool_risk_overrides: Optional[Mapping[str, str]] = None,
        updated_at: Optional[str] = None) -> GovernanceSettings
    func GetGovernanceSettings(ctx *Context, name string, id IDInput, state *GovernanceSettingsState, opts ...ResourceOption) (*GovernanceSettings, error)
    public static GovernanceSettings Get(string name, Input<string> id, GovernanceSettingsState? state, CustomResourceOptions? opts = null)
    public static GovernanceSettings get(String name, Output<String> id, GovernanceSettingsState state, CustomResourceOptions options)
    resources:  _:    type: thoth:governance:GovernanceSettings    get:      id: ${id}
    import {
  to = thoth_governance_governance_settings.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    CanonicalRegimes List<string>
    Canonical declared regimes. Known during planning for known declarations.
    ComplianceCatalogueSha256 string
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    ComplianceCoverage Dictionary<string, AtenSecurity.GovernanceSettingsComplianceCoverageArgs>
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    ComplianceEnforcementMode string
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    ComplianceEvaluatorSha256 string
    Pinned evaluator identity, checked before mutation.
    ComplianceProfile string
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    ComplianceRevision int
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    DeclaredRegulatoryRegimes List<string>
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    ExtraSettingsJson string
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    ModelRouterAllowedModels List<string>
    Allowed model names allowlist.
    ModelRouterAllowedProviders List<string>
    Allowed model providers allowlist.
    ModelRouterDefaultModel string
    Default model name.
    ModelRouterDefaultProvider string
    Default model provider.
    ModelRouterEnabled bool
    Enable model routing policy controls.
    ModelRouterFailoverProviders List<string>
    Failover provider order.
    PropagationMaxMs int
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    RegimesWithoutControls List<string>
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    RegulatoryRegimes List<string>
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    SecretBrokerAllowedHosts List<string>
    Allowed host patterns for secret broker.
    SecretBrokerAuthBindingsJson string
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    SecretBrokerEnabled bool
    Enable secret broker policy enforcement.
    SecretBrokerFailOnMissingSecret bool
    Fail governed calls when referenced secret is unavailable.
    SecretBrokerProvider string
    Secret broker provider slug.
    SecretBrokerStrictEndpointMode bool
    Require endpoint registration for secret resolution.
    ShadowCritical string
    Default action for critical risk events.
    ShadowHigh string
    Default action for high risk events.
    ShadowLow string
    Default action for low risk events.
    ShadowMedium string
    Default action for medium risk events.
    TenantId string
    Tenant ID resolved from provider configuration.
    ToolRiskOverrides Dictionary<string, string>
    Tool-specific risk tier overrides.
    UpdatedAt string
    Last update timestamp returned by GovAPI.
    CanonicalRegimes []string
    Canonical declared regimes. Known during planning for known declarations.
    ComplianceCatalogueSha256 string
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    ComplianceCoverage map[string]GovernanceSettingsComplianceCoverageArgs
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    ComplianceEnforcementMode string
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    ComplianceEvaluatorSha256 string
    Pinned evaluator identity, checked before mutation.
    ComplianceProfile string
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    ComplianceRevision int
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    DeclaredRegulatoryRegimes []string
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    ExtraSettingsJson string
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    ModelRouterAllowedModels []string
    Allowed model names allowlist.
    ModelRouterAllowedProviders []string
    Allowed model providers allowlist.
    ModelRouterDefaultModel string
    Default model name.
    ModelRouterDefaultProvider string
    Default model provider.
    ModelRouterEnabled bool
    Enable model routing policy controls.
    ModelRouterFailoverProviders []string
    Failover provider order.
    PropagationMaxMs int
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    RegimesWithoutControls []string
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    RegulatoryRegimes []string
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    SecretBrokerAllowedHosts []string
    Allowed host patterns for secret broker.
    SecretBrokerAuthBindingsJson string
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    SecretBrokerEnabled bool
    Enable secret broker policy enforcement.
    SecretBrokerFailOnMissingSecret bool
    Fail governed calls when referenced secret is unavailable.
    SecretBrokerProvider string
    Secret broker provider slug.
    SecretBrokerStrictEndpointMode bool
    Require endpoint registration for secret resolution.
    ShadowCritical string
    Default action for critical risk events.
    ShadowHigh string
    Default action for high risk events.
    ShadowLow string
    Default action for low risk events.
    ShadowMedium string
    Default action for medium risk events.
    TenantId string
    Tenant ID resolved from provider configuration.
    ToolRiskOverrides map[string]string
    Tool-specific risk tier overrides.
    UpdatedAt string
    Last update timestamp returned by GovAPI.
    canonical_regimes list(string)
    Canonical declared regimes. Known during planning for known declarations.
    compliance_catalogue_sha256 string
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    compliance_coverage map(object)
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    compliance_enforcement_mode string
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    compliance_evaluator_sha256 string
    Pinned evaluator identity, checked before mutation.
    compliance_profile string
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    compliance_revision number
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    declared_regulatory_regimes list(string)
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    extra_settings_json string
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    model_router_allowed_models list(string)
    Allowed model names allowlist.
    model_router_allowed_providers list(string)
    Allowed model providers allowlist.
    model_router_default_model string
    Default model name.
    model_router_default_provider string
    Default model provider.
    model_router_enabled bool
    Enable model routing policy controls.
    model_router_failover_providers list(string)
    Failover provider order.
    propagation_max_ms number
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    regimes_without_controls list(string)
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    regulatory_regimes list(string)
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    secret_broker_allowed_hosts list(string)
    Allowed host patterns for secret broker.
    secret_broker_auth_bindings_json string
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    secret_broker_enabled bool
    Enable secret broker policy enforcement.
    secret_broker_fail_on_missing_secret bool
    Fail governed calls when referenced secret is unavailable.
    secret_broker_provider string
    Secret broker provider slug.
    secret_broker_strict_endpoint_mode bool
    Require endpoint registration for secret resolution.
    shadow_critical string
    Default action for critical risk events.
    shadow_high string
    Default action for high risk events.
    shadow_low string
    Default action for low risk events.
    shadow_medium string
    Default action for medium risk events.
    tenant_id string
    Tenant ID resolved from provider configuration.
    tool_risk_overrides map(string)
    Tool-specific risk tier overrides.
    updated_at string
    Last update timestamp returned by GovAPI.
    canonicalRegimes List<String>
    Canonical declared regimes. Known during planning for known declarations.
    complianceCatalogueSha256 String
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    complianceCoverage Map<String,GovernanceSettingsComplianceCoverageArgs>
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    complianceEnforcementMode String
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    complianceEvaluatorSha256 String
    Pinned evaluator identity, checked before mutation.
    complianceProfile String
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    complianceRevision Integer
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    declaredRegulatoryRegimes List<String>
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    extraSettingsJson String
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    modelRouterAllowedModels List<String>
    Allowed model names allowlist.
    modelRouterAllowedProviders List<String>
    Allowed model providers allowlist.
    modelRouterDefaultModel String
    Default model name.
    modelRouterDefaultProvider String
    Default model provider.
    modelRouterEnabled Boolean
    Enable model routing policy controls.
    modelRouterFailoverProviders List<String>
    Failover provider order.
    propagationMaxMs Integer
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    regimesWithoutControls List<String>
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    regulatoryRegimes List<String>
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    secretBrokerAllowedHosts List<String>
    Allowed host patterns for secret broker.
    secretBrokerAuthBindingsJson String
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    secretBrokerEnabled Boolean
    Enable secret broker policy enforcement.
    secretBrokerFailOnMissingSecret Boolean
    Fail governed calls when referenced secret is unavailable.
    secretBrokerProvider String
    Secret broker provider slug.
    secretBrokerStrictEndpointMode Boolean
    Require endpoint registration for secret resolution.
    shadowCritical String
    Default action for critical risk events.
    shadowHigh String
    Default action for high risk events.
    shadowLow String
    Default action for low risk events.
    shadowMedium String
    Default action for medium risk events.
    tenantId String
    Tenant ID resolved from provider configuration.
    toolRiskOverrides Map<String,String>
    Tool-specific risk tier overrides.
    updatedAt String
    Last update timestamp returned by GovAPI.
    canonicalRegimes string[]
    Canonical declared regimes. Known during planning for known declarations.
    complianceCatalogueSha256 string
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    complianceCoverage {[key: string]: GovernanceSettingsComplianceCoverageArgs}
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    complianceEnforcementMode string
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    complianceEvaluatorSha256 string
    Pinned evaluator identity, checked before mutation.
    complianceProfile string
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    complianceRevision number
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    declaredRegulatoryRegimes string[]
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    extraSettingsJson string
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    modelRouterAllowedModels string[]
    Allowed model names allowlist.
    modelRouterAllowedProviders string[]
    Allowed model providers allowlist.
    modelRouterDefaultModel string
    Default model name.
    modelRouterDefaultProvider string
    Default model provider.
    modelRouterEnabled boolean
    Enable model routing policy controls.
    modelRouterFailoverProviders string[]
    Failover provider order.
    propagationMaxMs number
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    regimesWithoutControls string[]
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    regulatoryRegimes string[]
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    secretBrokerAllowedHosts string[]
    Allowed host patterns for secret broker.
    secretBrokerAuthBindingsJson string
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    secretBrokerEnabled boolean
    Enable secret broker policy enforcement.
    secretBrokerFailOnMissingSecret boolean
    Fail governed calls when referenced secret is unavailable.
    secretBrokerProvider string
    Secret broker provider slug.
    secretBrokerStrictEndpointMode boolean
    Require endpoint registration for secret resolution.
    shadowCritical string
    Default action for critical risk events.
    shadowHigh string
    Default action for high risk events.
    shadowLow string
    Default action for low risk events.
    shadowMedium string
    Default action for medium risk events.
    tenantId string
    Tenant ID resolved from provider configuration.
    toolRiskOverrides {[key: string]: string}
    Tool-specific risk tier overrides.
    updatedAt string
    Last update timestamp returned by GovAPI.
    canonical_regimes Sequence[str]
    Canonical declared regimes. Known during planning for known declarations.
    compliance_catalogue_sha256 str
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    compliance_coverage Mapping[str, GovernanceSettingsComplianceCoverageArgs]
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    compliance_enforcement_mode str
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    compliance_evaluator_sha256 str
    Pinned evaluator identity, checked before mutation.
    compliance_profile str
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    compliance_revision int
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    declared_regulatory_regimes Sequence[str]
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    extra_settings_json str
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    model_router_allowed_models Sequence[str]
    Allowed model names allowlist.
    model_router_allowed_providers Sequence[str]
    Allowed model providers allowlist.
    model_router_default_model str
    Default model name.
    model_router_default_provider str
    Default model provider.
    model_router_enabled bool
    Enable model routing policy controls.
    model_router_failover_providers Sequence[str]
    Failover provider order.
    propagation_max_ms int
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    regimes_without_controls Sequence[str]
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    regulatory_regimes Sequence[str]
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    secret_broker_allowed_hosts Sequence[str]
    Allowed host patterns for secret broker.
    secret_broker_auth_bindings_json str
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    secret_broker_enabled bool
    Enable secret broker policy enforcement.
    secret_broker_fail_on_missing_secret bool
    Fail governed calls when referenced secret is unavailable.
    secret_broker_provider str
    Secret broker provider slug.
    secret_broker_strict_endpoint_mode bool
    Require endpoint registration for secret resolution.
    shadow_critical str
    Default action for critical risk events.
    shadow_high str
    Default action for high risk events.
    shadow_low str
    Default action for low risk events.
    shadow_medium str
    Default action for medium risk events.
    tenant_id str
    Tenant ID resolved from provider configuration.
    tool_risk_overrides Mapping[str, str]
    Tool-specific risk tier overrides.
    updated_at str
    Last update timestamp returned by GovAPI.
    canonicalRegimes List<String>
    Canonical declared regimes. Known during planning for known declarations.
    complianceCatalogueSha256 String
    Pinned catalogue identity. Apply fails before mutation if the running catalogue differs.
    complianceCoverage Map<Property Map>
    Per-regime author classifications from the pinned executable catalogue, available before first apply. These counts are not a regulatory conformance assessment.
    complianceEnforcementMode String
    Required with a nonempty declaration: observe evaluates and records advisory findings while preserving independent authorization; enforce adds non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED. Changing mode affects every tenant agent within 1000 ms. Structurally unserved regimes report coverage gaps and add no action restriction.
    complianceEvaluatorSha256 String
    Pinned evaluator identity, checked before mutation.
    complianceProfile String
    Compliance profile (soc2, healthcare, financial, public_sector, privacy, ai_governance).
    complianceRevision Number
    Revision used for optimistic concurrency. A stale apply or destroy fails without replacing a newer declaration.
    declaredRegulatoryRegimes List<String>
    Explicit executable compliance declaration for all current and future tenant agents. Case and separators are ignored. Removing a managed declaration or setting [] clears it. Legacy profile defaults never activate this binding.
    extraSettingsJson String
    Additional JSON object merged into the outgoing settings payload for forward compatibility.
    modelRouterAllowedModels List<String>
    Allowed model names allowlist.
    modelRouterAllowedProviders List<String>
    Allowed model providers allowlist.
    modelRouterDefaultModel String
    Default model name.
    modelRouterDefaultProvider String
    Default model provider.
    modelRouterEnabled Boolean
    Enable model routing policy controls.
    modelRouterFailoverProviders List<String>
    Failover provider order.
    propagationMaxMs Number
    Maximum positive cache lifetime for declaration changes: 1000 milliseconds.
    regimesWithoutControls List<String>
    Declared regimes with no executable controls. These are coverage gaps, never a clean result or a per-action restriction.
    regulatoryRegimes List<String>
    Explicit regulatory regimes for onboarding baseline auto-pack loading (for example: soc2, hipaa, gdpr, fedramp, sec_cftc). Legacy packs only; defaults to SOC2 when unset. Does not activate executable compliance.
    secretBrokerAllowedHosts List<String>
    Allowed host patterns for secret broker.
    secretBrokerAuthBindingsJson String
    JSON array of auth binding objects (host_pattern, header, secret_ref, prefix).
    secretBrokerEnabled Boolean
    Enable secret broker policy enforcement.
    secretBrokerFailOnMissingSecret Boolean
    Fail governed calls when referenced secret is unavailable.
    secretBrokerProvider String
    Secret broker provider slug.
    secretBrokerStrictEndpointMode Boolean
    Require endpoint registration for secret resolution.
    shadowCritical String
    Default action for critical risk events.
    shadowHigh String
    Default action for high risk events.
    shadowLow String
    Default action for low risk events.
    shadowMedium String
    Default action for medium risk events.
    tenantId String
    Tenant ID resolved from provider configuration.
    toolRiskOverrides Map<String>
    Tool-specific risk tier overrides.
    updatedAt String
    Last update timestamp returned by GovAPI.

    Supporting Types

    GovernanceSettingsComplianceCoverage, GovernanceSettingsComplianceCoverageArgs

    Enforced int
    Action-time controls with executable predicates.
    EvidenceGap int
    Controls classified as evidence gaps.
    NotActionTime int
    Controls outside action-time enforcement.
    Total int
    Total classified controls.
    Enforced int
    Action-time controls with executable predicates.
    EvidenceGap int
    Controls classified as evidence gaps.
    NotActionTime int
    Controls outside action-time enforcement.
    Total int
    Total classified controls.
    enforced number
    Action-time controls with executable predicates.
    evidence_gap number
    Controls classified as evidence gaps.
    not_action_time number
    Controls outside action-time enforcement.
    total number
    Total classified controls.
    enforced Integer
    Action-time controls with executable predicates.
    evidenceGap Integer
    Controls classified as evidence gaps.
    notActionTime Integer
    Controls outside action-time enforcement.
    total Integer
    Total classified controls.
    enforced number
    Action-time controls with executable predicates.
    evidenceGap number
    Controls classified as evidence gaps.
    notActionTime number
    Controls outside action-time enforcement.
    total number
    Total classified controls.
    enforced int
    Action-time controls with executable predicates.
    evidence_gap int
    Controls classified as evidence gaps.
    not_action_time int
    Controls outside action-time enforcement.
    total int
    Total classified controls.
    enforced Number
    Action-time controls with executable predicates.
    evidenceGap Number
    Controls classified as evidence gaps.
    notActionTime Number
    Controls outside action-time enforcement.
    total Number
    Total classified controls.

    Package Details

    Repository
    thoth atensecurity/pulumi-thoth
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the thoth Terraform Provider.
    thoth logo Thoth
    Viewing docs for Thoth v0.1.22
    published on Sunday, Oct 25, 2026 by Aten Security
    Schema (JSON)
    atensecurity/pulumi-thoth

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial