from gaas_sdk import GaaSClient, build_intent async with GaaSClient("https://api.gaas.is", api_key="gsk_...") as client: intent = build_intent( agent_id="my-agent-v1", action_type="TRANSACT", verb="initiate_payment", target="vendor_account_9912", summary="Pay invoice INV-2026-0044 for SaaS services", ) decision = await client.submit_intent(intent) print(decision.verdict) # APPROVE | BLOCK | ESCALATE
import { GaaSClient, buildIntent } from '@governancehq/sdk'; const client = new GaaSClient({ baseUrl: 'https://api.gaas.is', apiKey: 'gsk_...' }); const intent = buildIntent({ agentId: 'my-agent-v1', actionType: 'TRANSACT', verb: 'initiate_payment', target: 'vendor_account_9912', summary: 'Pay invoice INV-2026-0044 for SaaS services', }); const decision = await client.submitIntent(intent); console.log(decision.verdict); // APPROVE | BLOCK | ESCALATE
curl -X POST https://api.gaas.is/v1/intents \ -H "X-API-Key: gsk_..." \ -H "Content-Type: application/json" \ -d '{ "intent": { "agent": { "id": "my-agent-v1" }, "action": { "type": "TRANSACT", "verb": "initiate_payment", "target": { "identifier": "vendor_account_9912" } }, "payload": { "summary": "Pay invoice INV-2026-0044" } } }'
Getting Started
Quickstart, API key provisioning, your first governance decision.
API Reference
Complete OpenAPI spec — all endpoints, request and response schemas.
Onboarding
Intake, UCM builder, membrane generation, and the shadow → live lifecycle.
SDKs
Python, TypeScript, Java, and LangChain client libraries with full intent builder support.
Intent Declaration API
Action types, shadow mode, batch submission, and governance verdicts.
Policy Library
60 policies — HIPAA, GDPR, PCI-DSS, SOX, AP2, EU AI Act, NIST, FedRAMP, CMMC.
Connectors
27 production integrations — Okta, SIEM, Stripe, GitHub, Slack, IoT, fleet, agriculture.
Connect Your Systems
Your own HTTPS endpoint answers the facts GaaS's policies check, during every decision. Signed requests; secrets encrypted with AWS KMS.
A2A & Agent Networks
A2A Protocol v1.0, Agent Trust Registry, AP2 payment governance.
Shadow Mode
Full pipeline evaluation, zero enforcement. Test on live traffic safely.
Conversational Dashboard
Governance operations via natural language — powered by Claude.
Observability & Alerting
Structured logging, Prometheus metrics, OTel tracing, anomaly detection.
Webhooks
HMAC-signed event delivery for decisions, escalations, and quota events.
SIEM Alerts
Send blocks and escalations to Splunk, Sentinel, Datadog, or any SIEM.
Authentication
API keys, multi-tenancy, OAuth, MFA, and org isolation.
Rate Limits
Per-endpoint sliding-window throttling and 429 backoff patterns.
Advanced Features
NL policy authoring, proof tokens, public timestamps, co-signing, feature flags, appeals.
Load Testing
k6 smoke, load, and stress profiles — CI-gated between staging and production.
Compliance & Liability Shield
EU AI Act, NIST AI RMF, SP 800-53, FedRAMP, CMMC, model inventory, Governance Proof Tokens.
GDPR Compliance
Data subject rights (Arts. 17, 20, 22), consent management, sub-processor automation.
Billing & Quotas
4-tier pricing, usage enforcement, multi-currency, Stripe Tax.
The Record Is Free Forever
Our standing pledge: audit creation, export, and verification are never paywalled — enforced in CI.
Public Audit Timestamps
Every day of your audit trail stamped into Bitcoin with OpenTimestamps. Check it yourself with the official client.
The auth.md Spec
Governance as files: the open .gaas/ convention — auth.md, policy.md, audit.md, escalation.md, attestation.sig.
SLA
Availability commitments, credit tiers, and incident definitions by plan.