Get Started with Aeion Governance

The governance module exposes a roll-up endpoint that drives the admin homepage widget and powers the sidebar badge. Call it any time to see open work, posture, and active alerts:

bash GET /api/governance/stats

json { "data": { "pendingApprovals": 4, "activePolicies": 27, "recentChanges": 12, "complianceScore": 92, "alerts": [ { "type": "approval", "severity": "medium", "message": "4 approval requests awaiting review", "timestamp": "2026-05-20T10:00:00Z" } ] } }

For the sidebar badge alone, use the cheaper count endpoint:

bash GET /api/governance/approvals/pending-count

json { "data": { "count": 4 } }

Risk roll-up (open requests, overdue requests, non-compliant resources):

bash GET /api/governance/risk/summary

json { "data": { "totalRequests": 142, "openRequests": 6, "overdueRequests": 1, "nonCompliantResources": 3 } }

Aeion records audit events in gov_audit_trails. Every row carries a SHA-256 hash that chains to the previous entry, so any historical edit is detectable on verification. Other modules call the audit service directly; for direct API access, post to the collection:

bash POST /api/v1/gov_audit_trails { "timestamp": "2026-05-20T10:15:00Z", "data": { "action": "update", "actor": "<userId>", "resource": "customer_record", "resourceId": "cust-123", "before": { "status": "active" }, "after": { "status": "suspended" }, "ip": "192.168.1.100", "classification": { "sensitivity": "high", "complianceFrameworks": ["SOC2", "GDPR"], "requiresRetention": true } } }

Export the audit trail (CSV download — handy for SOC2 auditors and incident response):

bash GET /api/governance/audit/export GET /api/governance/audit/export?startDate=2026-01-01&endDate=2026-12-31 GET /api/governance/audit/export?action=update&actor=<userId>

Returns up to 10,000 rows as text/csv with content-disposition header for browser download. Columns: id, timestamp, action, actor, resource, resourceId, details.

Query specific entries via auto-CRUD with JSON-path filters:

bash GET /api/v1/gov_audit_trails?where[data.action][equals]=delete&sort=-timestamp&limit=100

Compliance frameworks live in gov_compliance_frameworks and the engine writes per-resource results to gov_compliance_logs. SOC2, GDPR, ISO 27001, HIPAA, and PCI-DSS ship as seed framework templates — extend or add new ones as collection rows.

List available frameworks:

bash GET /api/governance/compliance/frameworks

Evaluate a framework (admin only — sweeps every applicable resource for the tenant):

bash POST /api/governance/compliance/evaluate { "frameworkId": "<frameworkId>" }

json { "data": { "framework": "<frameworkId>", "passed": 45, "failed": 3, "warnings": 8, "results": [ { "resourceType": "user", "resourceId": "u-1", "status": "compliant" }, { "resourceType": "encryption_key", "resourceId": "k-9", "status": "non_compliant", "controlId": "CC6.6" } ] } }

Get current status across all frameworks:

bash GET /api/governance/compliance/status

Get status for a specific framework:

bash GET /api/governance/compliance/status/<frameworkId>

Ad-hoc check for a single resource (useful right after a sensitive operation):

bash POST /api/governance/compliance/check { "frameworkId": "<frameworkId>", "resourceType": "customer_record", "resourceId": "cust-123" }

Returns a gov_compliance_logs row recording the check result, the controlling check function, and the tenant + user who triggered it.

Approval requests live in gov_requests. Policies — who can approve what, under what conditions — live in gov_policies. Delegations (vacation coverage, role transitions) live in gov_delegations.

Define an approval policy (auto-CRUD):

bash POST /api/v1/gov_policies { "name": "Budget Approval Over $10,000", "status": "active", "priority": 1, "data": { "conditions": [ { "field": "amount", "operator": "greaterThan", "value": 10000 }, { "field": "type", "operator": "equals", "value": "expense" } ], "approvers": [ { "type": "role", "role": "vp_finance" }, { "type": "user", "id": "<cfoId>" } ], "escalationHours": 48, "requireUnanimous": false } }

Submit an approval request:

bash POST /api/v1/gov_requests { "type": "expense", "status": "pending", "dueDate": "2026-05-22T17:00:00Z", "data": { "amount": 25000, "vendor": "Office Supplies Inc", "description": "Q3 equipment purchase", "requestedBy": "<userId>" } }

The policy engine matches the request to the highest-priority policy, computes the approver set (substituting delegates for any approver currently on leave), and writes the result back to the request row.

Approve or reject:

bash POST /api/governance/approvals/requests/<requestId>/decide { "decision": "approved", "comments": "Within Q3 budget" }

Decisions are recorded with approverId (from the authenticated user), audit-stamped, and the request status transitions to approved or rejected. If unanimous approval is required, the row stays pending until every approver has decided.

Create a delegation for vacation coverage:

bash POST /api/v1/gov_delegations { "delegatorId": "<managerId>", "delegateId": "<backupId>", "fromDate": "2026-07-01", "toDate": "2026-07-14", "reason": "Annual vacation", "status": "active", "data": { "scope": { "policyIds": ["<budget-approval-policy-id>", "<purchase-policy-id>"], "maxAmount": 50000, "types": ["expense", "purchase_order"] }, "notifyOnDelegation": true, "notifyOnReturn": true } }

Overlapping delegations are blocked by the service when it creates a row (date range check against existing active delegations for the same delegator).

Two final collections close the governance loop. Both are pure auto-CRUD — the heavy lifting happens in scheduled jobs and event-driven workers.

Retention policy — declares how long records of a given collection live, and what to do when they're past their date:

bash POST /api/v1/gov_retention_policies { "name": "Customer Records — 7 Year Retention", "collection": "customers", "status": "active", "data": { "conditions": [ { "field": "status", "operator": "equals", "value": "inactive" } ], "retentionPeriod": { "duration": 7, "unit": "years" }, "archiveBeforeDelete": true, "archiveStorageLocation": "s3://aeion-archive/customers", "encryption": "AES-256" } }

A nightly cron evaluates active policies, archives matching rows to the configured storage location, and writes a deletion audit trail before removing the originals. The retention worker is the only path to permanent deletion — every step ends up in gov_audit_trails.

Change requests — track infrastructure or policy changes that need governance review:

bash POST /api/v1/gov_change_requests { "title": "Migrate to new S3 archive bucket", "type": "retention_change", "status": "pending", "riskLevel": "medium", "data": { "before": { "bucket": "old-archive" }, "after": { "bucket": "new-archive" }, "rollbackPlan": "Switch bucket env var back; archives are dual-written for 30 days", "estimatedDowntime": 0, "affectedSystems": ["governance", "legal"] } }

Access policies — fine-grained per-resource access rules, evaluated in priority order:

bash POST /api/v1/gov_access_policies { "name": "Restrict PII reads after hours", "resource": "customers", "priority": 10, "effect": "deny", "data": { "conditions": [ { "field": "operation", "operator": "equals", "value": "read" }, { "field": "fieldGroup", "operator": "equals", "value": "pii" }, { "field": "hour", "operator": "outsideRange", "value": [9, 18] } ] } }

Sorted by priority ascending; first matching policy wins; no match = default deny.