Govern
The controls that bound and gate LLM traffic — governance policies that rewrite or reject non-compliant requests, spend policies, quotas, model allow-lists, API keys, members and SSO — plus environments, the telemetry policy and export destinations.
The Govern pillar is where you bound what callers can do and who can do it: the inline controls the gateway enforces on every request, and the organisation configuration behind day-to-day operation.
Governance policies
A governance policy bounds the structural shape of a request before it reaches the provider. Each policy is scope × rules × enforcement:
- Scope — apply to all traffic, or narrow to an app, environment, model, provider, API key or user.
- Rules — cap
max_tokens; cap reasoning effort (OpenAIreasoning_effort) or thinking budget (Anthropicthinking.budget_tokens); clamptemperature; restrict the allowed models (with an optional default the request is rewritten to); pinservice_tier; allow or deny tools by name; require a structured (json_schema) response; require an end-user identifier. - Enforcement —
enforcerewrites the request to comply and forwards it,blockrejects a violating request with422,warnrecords the would-be change and passes the request through unchanged.
Every decision is stamped on the recorded span (axonpush.govern.action), so the
Gateway traffic view and the audit log show exactly what
was capped, stripped, rewritten or blocked. Manage policies under Govern →
Governance policies; the API is /govern-policies (scope govern:manage).
Spend policies
A spend policy sets a USD limit over a window (daily, weekly, monthly or cumulative) and steps through a ladder as spend climbs: notify, fall back to a cheaper model, then block. Scope each to an app, environment, model, key, user or tag. Spend is computed from recorded cost, so there is one source of truth.
Quotas and models
Quotas cap event volume against your plan; Models is the allow-list of the models your org may call. Both surface under the Govern pillar.
API keys, members and SSO
- API keys (
ak_) authenticate server-side code and the gateway, scoped and revocable, optionally pinned to an app and environment. - Members and roles — invite teammates, set roles, and transfer ownership. Changes are recorded in the audit log.
- SSO — connect an identity provider for organisation sign-in.
Environments and the telemetry policy
dev, staging and prod isolate traffic. Every event carries an environment,
credentials pin to one, and the read APIs filter on one. See
Environments for the resolution rules.
The telemetry policy decides how much prompt, message and tool content is kept.
Its default contentCaptureMode is metadata_only, and it also carries redacted
paths, regex rules and per-environment overrides. Credential-shaped keys are
always redacted regardless of mode. See
the privacy boundary.
Export destinations
An export destination forwards every matching event back out over OTLP/HTTP, so axonpush can sit alongside a Datadog, Honeycomb or Grafana pipeline. Destinations are scoped to one environment. See OTLP out.
Moderation
Rules that inspect the content flowing through your agents, and the violations they raise, from a keyword or regex match to a built-in detector.
Compliance
The evidence trail, an append-only audit log of organisation-level change, plus the retention and privacy controls that decide how long data lives and how much of it is kept.