Why governance belongs in the process

There are two places to put the thing that decides whether an agent may act: in a service the agent calls, or in the agent itself. The first is easier to build and easier to sell. The second is the only one that can actually stop a call.

A remote check is a suggestion

If the policy decision happens over the network, then between the decision and the action there is a gap, and in that gap the agent process holds all the authority. It has the credentials. It has the network. Nothing structurally prevents it from acting while the check is in flight, or after a denial, or when the policy service is down.

That last case is the one that decides the design. When the policy service is unreachable, a remote checker has two options: fail open and keep working, or fail closed and halt. In practice systems fail open, because the alternative is an outage. Which means the control is strongest when nothing is wrong and weakest exactly when something is.

In-process enforcement has no gap. The policy is evaluated before the call is constructed. A denied call is not blocked at the boundary — it never happens.

Fail closed, including when the policy itself breaks

Deny-by-default is the easy half. The harder half is what happens when the evaluator raises.

In infy, a policy that throws produces a forbid, not an allow. The governance hook wraps the engine and converts any exception into an audited denial. A bug in a policy cannot become an open door, and the denial is still recorded, so the failure is visible rather than silent.

That property is only available in-process. A policy service that crashes cannot record its own crash as a denial on the caller's behalf.

The seam is the product boundary

None of this argues against a control plane. It argues about what belongs in it.

Policy evaluation belongs next to the action. Policy management — history, review, who changed what — does not, and neither does the approval queue, or the durable record. Those need to outlive the process, and a process is a bad place to keep anything that has to outlive it.

So the line falls at the network boundary: enforcement local, evidence and management remote. Commercial features attach behind the same protocol seams the open library already exposes, which means the paid layer can be swapped out without touching the part that enforces.

Why the enforcement code is open

A control plane you cannot read is one you cannot trust. If you cannot audit the component that decides what your agents may do, you have relocated the problem rather than solved it.

That is why the policy engine, the risk tiering, the approval gates, and the audit chain are all Apache-2.0. You can read exactly how a denial is reached. You can run the whole thing with no account and no network. What we sell is the part that has to be somewhere you don't control — which is precisely the part where trust has to be earned differently.