The agent-governance pack (packs:agent-governance)

packs:agent-governance

packs:agent-governance licenses the governance funnel over the base agent capability: granting trust, deciding grants, reading the evidence. The split is engine-in-base, pack-gates-the-funnel — the enforcement engine (the compiled trust trie, tier resolution, the approval gate injection, halt verbs, audit emission) ships in base and runs identically everywhere; the pack gates the surfaces that create and review authority. The platform story and the funnel's semantics are opschain docs agent-plane; this page is the entitlement line through them.

packs:agents is the sibling that admits agents onto the platform at all; this pack governs what they may do once there, and an AI-type enrolment hard-depends on it (below).

What the pack gates

Each of these refuses by name without the entitlement — 403 on the REST routes with this surface requires the "packs:agent-governance" entitlement - the <tier> licence does not include it; apply the licence pack that grants it (opschain admin licence apply), and permission_denied with ERROR_REASON_PACK_ENTITLEMENT_REQUIRED on the v2 twins:

• Trust-grant creation and decisions — grant create, approve and reject, and the grants listing (opschain admin trust grant|list|approve|reject).
• The recommendations lifecycle — filing, listing, reading, accepting and dismissing recommendations (the ADVISE tier's output lane).
• The per-agent review surfaces — GET /api/agents/{id}/activity (the audit timeline) and …/trust-review (the decision-support view), REST and v2 alike.
• The tier-ceiling verbs — the type ceilings and the node-classification ceilings, reads and writes.
• The signed AgentRelease catalog — signing-key administration, release creation, promotion, and the catalog reads.
• The held ceremonies' reviewer verbs — a trust raise or an AgentRelease prod promotion held in the one approvals inbox is admitted by packs:change-governance OR this pack, so an estate holding only the agent pack can still decide its own agent subjects (see change governance).

The funnel's reads are delegable without admin status — read on /governance/agents admits a reviewer role to the trust surface read-only — but the pack gate applies unchanged beneath the role. A named approver on an open trust raise (or its requester) additionally reads THAT agent's detail and trust review without the role — the approver-scoped subject read (opschain docs change-governance, "What an approver may read"); the pack gate still applies beneath it.

What is base, and NEVER gated

This split is the pack's heart: a lapsed estate can always shed authority, never gain it.

• Enrolment and the channel — agents register, connect and serve under packs:agents; this pack never touches the wire.
• Tier enforcement on the request lane — existing grants keep compiling and keep governing: the trie walk, the ADVISE refusal, the SUPERVISED approval gate and the ceilings all run in base, so a lapse never silently widens what an agent may do.
• Assignments — the trust assignment verbs, the ADVISE floor's carrier, stay open.
• Grant revoke — shedding authority is never licence-gated; a proposed or direct revoke works on any tier.
• The halt scalpels — drain, halt, revoke, forget, the group and plane-wide forms: the kill switches work on an estate that never bought governance.
• The fleet views and the audit trail — what the agents did remains readable evidence.

One deliberate waiver: the opschain agent dev process-local sandbox skips the gate, exactly as the packs:agents gate does — its seeded trust profile must keep working on an unlicensed laptop; licensing gates estates, not the SDK's dev loop.

AI-type enrolment depends on this pack

An enrolment whose manifest declares type: ai hard-depends on packs:agent-governance + packs:ai-agents — the refusal names every missing pack, and lands the customer-visible warn:licence:feature_refused event. Ungoverned AI cannot even enrol: there is no configuration in which an LLM-driven agent runs outside this pack's funnel. The LLM lane itself is packs:ai-agents.

Lapse posture

On entitlement lapse nothing already granted changes: active grants keep compiling, tiers keep resolving, approval gates keep injecting, caps and ceilings keep clamping, and every refusal keeps auditing. What stops is movement upward — no new grants, no approvals of pending raises, no recommendations traffic, no review reads — while revoke, assignments, halt and the audit trail stay open for cleanup. Everything lights back up on re-entitlement; no stored grant or release is touched either way.

Related pages

• opschain docs agent-plane — the platform and the funnel's full semantics (tiers, grants, assignments, ceilings, the raise ceremony).
• opschain docs getting-started/12-2-enrol-own-assign-grant-ceiling — the hands-on governance walk-through; opschain docs getting-started/12-1-what-an-agent-is — the trust loop from enrolment to revocation.
• entitlements — the licence machinery and the full gate catalogue; packs:agents — the platform entitlement beneath this one; AI agents — the packs:ai-agents lane above it.
• opschain docs cli/admin-trust and cli/admin-agent-release — the gated command families; cli/admin-agent — the never-gated lifecycle verbs.