> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowx.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Governance

> Policy engine, risk scoring, evidence collection, and assessments — the controls layer for production AI.

Governance is the layer that turns "we can see what the agent does" into "we know it's allowed to do that". Use it to enforce policies before runs reach users, score risk per app, gather evidence with a review workflow, and run repeatable assessments.

***

## What's inside

> [card] [Policies](https://docs.flowx.ai/6.x/observatory/governance/policies.md)
>
> Define and assign governance rules, evaluate them against runs, score compliance.

> [card] [Evidence](https://docs.flowx.ai/6.x/observatory/governance/evidence.md)
>
> Collect, review, and approve evidence — automated or manual.

> [card] [Assessments](https://docs.flowx.ai/6.x/observatory/governance/assessments.md)
>
> Dynamic questionnaires with weighted scoring.

> [card] [Risk Dashboard](https://docs.flowx.ai/6.x/observatory/governance/risk-dashboard.md)
>
> Six-dimensional risk score per app, rolled up to the org.

> [card] [AI Registry](https://docs.flowx.ai/6.x/observatory/governance/ai-registry.md)
>
> Catalogue of models, deployments, and ownership.

***

## How governance fits together

```mermaid theme={"dark"}
flowchart LR
    Registry["AI Registry<br/>(what we have)"] --> Risk
    Policies["Policies<br/>(what's allowed)"] --> Risk
    Assessments["Assessments<br/>(how we check)"] --> Evidence
    Evidence["Evidence<br/>(proof)"] --> Risk
    Risk["Risk score<br/>(where to focus)"] --> Compliance[Compliance heatmap]
```

The AI Registry is the inventory layer — what exists in your portfolio. Policies and Assessments produce the inputs to risk scoring. Evidence is the artefact layer that proves controls are met. Risk rolls up the four into a single per-app score, and Compliance translates the score into framework-specific status.

***

## When to start where

| Maturity | Start with |
| - | - |
| You just got Observatory running | [AI Registry](https://docs.flowx.ai/6.x/observatory/governance/ai-registry.md) — catalogue what you have before governing it. |
| You have telemetry but no controls | [Policies](https://docs.flowx.ai/6.x/observatory/governance/policies.md) — the highest-leverage place to add guardrails. |
| You have policies but no audit trail | [Evidence](https://docs.flowx.ai/6.x/observatory/governance/evidence.md) — turn enforcement into proof. |
| You report to a risk committee | [Risk Dashboard](https://docs.flowx.ai/6.x/observatory/governance/risk-dashboard.md) — give them one number per app. |
| You need formal sign-off | [Assessments](https://docs.flowx.ai/6.x/observatory/governance/assessments.md) — structured, repeatable, scoreable. |

***

## Related resources

> [card] [Compliance](https://docs.flowx.ai/6.x/observatory/compliance/overview.md)
>
> Map controls to EU AI Act, NIST AI RMF, and ISO 42001.

> [card] [Observability](https://docs.flowx.ai/6.x/observatory/observability/overview.md)
>
> The telemetry that policies and risk scoring read from.


## Related topics

- [EU AI Act](https://docs.flowx.ai/6.x/observatory/compliance/eu-ai-act.md)
- [Risk Dashboard](https://docs.flowx.ai/6.x/observatory/governance/risk-dashboard.md)
- [Assessments](https://docs.flowx.ai/6.x/observatory/governance/assessments.md)
- [Evidence](https://docs.flowx.ai/6.x/observatory/governance/evidence.md)
- [Policies](https://docs.flowx.ai/6.x/observatory/governance/policies.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.