Governance & Compliance

Governance is Cedar-inspired ABAC, deny-wins, with bitmap row filtering and cell masking. Break-glass is the audited emergency override; legal hold is row-scoped immutability; WORM is retention-floor storage; DSAR is the GDPR subject-access request. These are the product differentiators — policy is in the query path, not bolted on.

21 methods across this domain. Signatures, parameters (incl. keyword-only tunable defaults), and the three SDK spellings are ported from the live SDK source; flagship methods carry a hand-written When to use + example.

GovernanceClient

import_sigma(sigma_yaml, purpose=None)

When to use. Import a Sigma detection rule (YAML) into the governed rule engine.

  • Python — client.governanceclient.import_sigma(sigma_yaml, purpose=None)
  • TypeScript — importSigma(sigmaYaml, opts)
  • Go — ImportSigma(sigmaYAML)

Parameters: sigma_yaml, purpose=None

Example

GovernanceClient.from_client(relata).import_sigma(sigma_yaml=open("rule.yml").read())

When to use. Freeze specific rows (row-scoped field/value) against modification/deletion.

  • Python — client.governanceclient.place_legal_hold(case_id, object_type, field=None, value=None)
  • TypeScript — placeLegalHold(caseId, objectType, opts)
  • Go — PlaceLegalHold(caseID, objectType)

Parameters: case_id, object_type, field=None, value=None

Example

GovernanceClient.from_client(relata).place_legal_hold("Person", field="_pk", value="p-42", reason="litigation-hold-7")

request_breakglass(source_id, purpose=None, justification=None)

When to use. Emergency override of a deny — audited, time-boxed, requires approval (ADR-261).

  • Python — client.governanceclient.request_breakglass(source_id, purpose=None, justification=None)
  • TypeScript — requestBreakglass(sourceId, opts)
  • Go — RequestBreakglass(sourceID)

Parameters: source_id, purpose=None, justification=None

Example

bg = GovernanceClient.from_client(relata).request_breakglass(
    source_id="incident-42", purpose="forensics", justification="SEV1: locked-out owner")

set_worm_policy(object_type, retention_secs)

When to use. Set a retention floor (WORM) on a type so rows cannot be deleted before retention_secs.

  • Python — client.governanceclient.set_worm_policy(object_type, retention_secs)
  • TypeScript — setWormPolicy(objectType, retentionSecs)
  • Go — SetWormPolicy(objectType, retentionSecs)

Parameters: object_type, retention_secs

Example

GovernanceClient.from_client(relata).set_worm_policy("AuditEvent", retention_secs=365*86400)

submit_dsar(subject_identity, reason, scope=None)

When to use. File a GDPR data-subject-access request; returns a governed export job.

  • Python — client.governanceclient.submit_dsar(subject_identity, reason, scope=None)
  • TypeScript — submitDsar(subjectIdentity, reason, opts)
  • Go — SubmitDSAR(subjectIdentity, reason)

Parameters: subject_identity, reason, scope=None

Example

GovernanceClient.from_client(relata).submit_dsar(subject="alice@x.io", scope="all")

add_rule_exception(rule_id, exception)

add_rule_exception(rule_id, exception)`

  • Python — client.governanceclient.add_rule_exception(rule_id, exception)
  • TypeScript — addRuleException(ruleId, exception)
  • Go — AddRuleException(ruleID, exception)

Parameters: rule_id, exception

approve_breakglass(request_id, approver_note=None)

approve_breakglass(request_id, approver_note=None)`

  • Python — client.governanceclient.approve_breakglass(request_id, approver_note=None)
  • TypeScript — approveBreakglass(requestId, opts)
  • Go — ApproveBreakglass(requestID)

Parameters: request_id, approver_note=None

breakglass_status(request_id)

breakglass_status(request_id)`

  • Python — client.governanceclient.breakglass_status(request_id)
  • TypeScript — breakglassStatus(requestId)
  • Go — BreakglassStatus(requestID)

Parameters: request_id

create_rule(rule, purpose=None)

create_rule(rule, purpose=None)`

  • Python — client.governanceclient.create_rule(rule, purpose=None)
  • TypeScript — createRule(rule, opts)
  • Go — CreateRule(rule)

Parameters: rule, purpose=None

disable_rule(rule_id)

disable_rule(rule_id)`

  • Python — client.governanceclient.disable_rule(rule_id)
  • TypeScript — disableRule(ruleId)
  • Go — DisableRule(ruleID)

Parameters: rule_id

get_rule_tuning(rule_id)

get_rule_tuning(rule_id)`

  • Python — client.governanceclient.get_rule_tuning(rule_id)
  • TypeScript — getRuleTuning(ruleId)
  • Go — GetRuleTuning(ruleID)

Parameters: rule_id

lift_legal_hold(case_id)`

  • Python — client.governanceclient.lift_legal_hold(case_id)
  • TypeScript — liftLegalHold(caseId)
  • Go — LiftLegalHold(caseID)

Parameters: case_id

list_alerts(severity=None, since_ns=None, limit=100)

list_alerts(severity=None, since_ns=None, limit=100)`

  • Python — client.governanceclient.list_alerts(severity=None, since_ns=None, limit=100)
  • TypeScript — listAlerts(opts)
  • Go — ListAlerts()

Parameters: severity=None, since_ns=None, limit=100

list_legal_holds()`

  • Python — client.governanceclient.list_legal_holds()
  • TypeScript — listLegalHolds()
  • Go — ListLegalHolds()

list_retention_policies()

list_retention_policies()`

  • Python — client.governanceclient.list_retention_policies()
  • TypeScript — listRetentionPolicies()
  • Go — ListRetentionPolicies()

list_rules(object_type=None)

list_rules(object_type=None)`

  • Python — client.governanceclient.list_rules(object_type=None)
  • TypeScript — listRules(opts)
  • Go — ListRules(objectType)

Parameters: object_type=None

list_worm_policies()

list_worm_policies()`

  • Python — client.governanceclient.list_worm_policies()
  • TypeScript — listWormPolicies()
  • Go — ListWormPolicies()

snooze_rule(rule_id, duration_secs)

snooze_rule(rule_id, duration_secs)`

  • Python — client.governanceclient.snooze_rule(rule_id, duration_secs)
  • TypeScript — snoozeRule(ruleId, durationSecs)
  • Go — SnoozeRule(ruleID, durationSecs)

Parameters: rule_id, duration_secs

suppress_rule(rule_id, entity_id, condition=None)

suppress_rule(rule_id, entity_id, condition=None)`

  • Python — client.governanceclient.suppress_rule(rule_id, entity_id, condition=None)
  • TypeScript — suppressRule(ruleId, entityId, opts)
  • Go — SuppressRule(ruleID, entityID)

Parameters: rule_id, entity_id, condition=None

update_alert(alert_id, status=None, assignee=None, note=None)

update_alert(alert_id, status=None, assignee=None, note=None)`

  • Python — client.governanceclient.update_alert(alert_id, status=None, assignee=None, note=None)
  • TypeScript — updateAlert(alertId, opts)
  • Go — UpdateAlert(alertID)

Parameters: alert_id, status=None, assignee=None, note=None

fromClient(client)

fromClient(client)`

  • TypeScript — fromClient(client)

Parameters: client