Conversational 0.7.19 is out: read the changelog

Governance

Connect one supported agent host, then inspect an observed action and the policy decision recorded for it.

Observe connected agent actions and use supported controls. Teams that need to connect agents, inspect observed actions and test the policies they configure.

Technical specifications

Discovery, observation and enforcement are separate. A detected installation is not necessarily reporting. A post-hoc log is not a pre-tool enforcement hook. A compatibility adapter is not a certified native integration.

Full product access for 180 days after activation. No subscription during the trial.

One connected-host event

Illustrative

write_file on a connected host

Review

A detected installation is not automatically reporting. The policy decision is recorded with the observed action.

host: local-agent · policy: write-review-v3

Local workspace Governance
Illustration, not a screenshot of the installed Governance app. One observed action and a policy decision.

One connected-host event

Connect one agent, wait for an observed action, then open the policy decision. If the daemon stops, new observations stop for that host.

  1. 01

    Install

    Create a dedicated environment, install the pinned Governance package, then run init.

  2. 02

    Connect one agent

    Start with one supported host. Confirm it is reporting, not only detected.

  3. 03

    Inspect a decision

    Open one observed action and the policy decision recorded for it.

Observed action and policy decision

Governance records observations and decisions. It does not invent hidden model reasoning. Local tamper evidence is not external WORM storage, legal certification, or proof of unobserved events.

What it does

  • Discovery of supported local agent installations
  • A detected installation is not necessarily reporting
  • Observed actions and policy decisions you configure
  • A post-hoc log is not a pre-tool enforcement hook
  • Open Evidence Kit as a separate verification resource

Requirements

The hardware guide lists install platforms and evidence limits. It does not size the AI you connect. See the hardware guide.

  • Python 3.10 or newer
  • Windows x64, Linux x86_64 with glibc 2.28 or newer, or macOS 15 on Apple silicon
  • At least one supported agent host you can connect

Supported connections

  • Hermes: host lifecycle hooks
  • OpenClaw: host lifecycle hooks
  • OpenCode: host lifecycle hooks
  • LangChain adapter: optional module
  • LangGraph adapter: optional module
  • CrewAI adapter: optional module
  • Email alerts: optional delivery, not an agent host
  • Slack: optional delivery, not an agent host
  • HTTPS webhook: optional delivery, not an agent host

Data handling

Indexes and source processing run on your device. Account, licensing, and optional connectors use MemStrata or destination services. If you choose a cloud answering model, the question and selected passages leave the device for that provider. Credentials stay in the operating-system credential vault. Customer content is not used for training unless the customer separately opts in.

Feature Local material Possible outbound Trigger Credential location
OAuth, signed entitlements, and device registration Device and entitlement cache Identity and device-bound entitlement fields Sign-in or refresh Operating-system credential vault
User-selected cloud model or connector Local evidence selection and indexes Only the data required for that explicit operation User configures and sends the request Operating-system credential vault
MemStrata-managed email Local alert or report draft Minimized message and recipient User-configured delivery; one message per signed-in user per UTC day during trial Server secret plus entitlement
Policy decisions, alerts, and optional archive Inventory, policy versions, observations, and hash-linked evidence Email, Slack, or HTTPS webhook payloads where live-tested; optional S3 archive User-configured alert or archive Operating-system credential vault or customer provider

Install

Install this product

Full product access for 180 days after activation. No subscription during the trial.

Detected: choose your system. Change the operating system if this is wrong.

Architecture

x64

Shell

PowerShell

MemStrata Governance 0.7.2 · Windows x64 · Python >=3.10

Windows 10 or newer, x64. This block installs the app, checks its version, then starts onboarding with memstrata-governance.cmd init

Get it from Microsoft Store

The Store listing is separate from this wheel command. The version the Store delivers can differ from a newer submission still in certification.

PyPI package page

Install with PowerShell (for developers)

PowerShell

$venv = "$env:USERPROFILE\MemStrata\venvs\governance"
py -3 -m venv "$venv"
if ($LASTEXITCODE -ne 0) { throw 'Could not create the environment.' }
$python = "$venv\Scripts\python.exe"
if (-not (Test-Path -LiteralPath $python)) {
  $python = (py -3 -c "import os, sys; print(os.path.realpath(sys.argv[1]))" $python).Trim()
}
if (-not (Test-Path -LiteralPath $python)) { throw 'Could not create the environment.' }
$scripts = Split-Path -Parent $python
& $python -m pip install --upgrade pip
if ($LASTEXITCODE -ne 0) { throw 'Could not update pip.' }
$wheel = 'https://files.pythonhosted.org/packages/5f/fa/121c7399f4ec5c4d132fbb3b81f213ed3428860d78b10d261086f557dc7e/memstrata_governance-0.7.2-py3-none-win_amd64.whl'
& $python -m pip install --only-binary=:all: "$wheel"
if ($LASTEXITCODE -ne 0) { throw 'Installation did not finish.' }
$actualVersion = (& "$scripts\memstrata-governance.cmd" --pypi-package-version | Out-String).Trim()
if ($LASTEXITCODE -ne 0 -or $actualVersion -ne '0.7.2') { throw 'The installed version does not match the advertised release.' }
Write-Output "Installed version: $actualVersion"
& "$scripts\memstrata-governance.cmd" init

memstrata_governance-0.7.2-py3-none-win_amd64.whl · sha256 39e716f1b57cbd4c7551dcc59469407f7917a0f19f124d8c678b450555e4a407

Python and platform requirements

A browser cannot reliably know your OS version or whether Python is installed. Python 3.10 or newer is required. If Python is missing, install it from python.org/downloads/windows and open a new terminal. The environment uses %USERPROFILE%\MemStrata\venvs to avoid Microsoft Store Python's LocalAppData redirection and resulting long package-cache paths. Interpreter realpath resolution is retained.

Troubleshooting

If setup stops, open the troubleshooting guide. Windows commands are PowerShell. Do not paste them into Command Prompt.

180 days of full product access after activation. No subscription during the trial. Reinstalling does not restart it. Model-provider charges, if any, are separate. MemStrata-managed email is limited to one message per signed-in user per UTC day. For access after the trial, contact us about paid access. Trial terms

FAQ

What can the product observe?

Actions reported by connected, supported hosts. A detected installation is not automatically an observing one.

Can a blocked action still run through another path?

Yes. A policy decision in Governance does not prove that every other path on the machine was blocked. A post-hoc log is not a pre-tool enforcement hook.

What happens when the daemon stops?

New observations stop for hosts that depend on it. Outage behavior is host-specific. Existing local evidence remains on the device.

What does a signature prove?

A signed selection proves the recorded bytes match the signature. It does not prove the answer was correct or that unobserved events did not happen.

Does this certify compliance?

No. A desktop install does not provision a certified archive or legal compliance. The open Evidence Kit is a separate verification resource.

Connect an agent