Governance Packs

Estimated reading time: 3 minutes

A governance pack is a named, versioned bundle of guardrails, intent rules, and compliance-risk mappings for a specific industry or framework. Installing a pack materializes its guardrails and intent rules into your organization; everything it installs stays fully editable afterward, and re-installing the same pack does not duplicate what you already have.

Packs available today

Three packs are currently shipped:

• HIPAA — Healthcare (hipaa-healthcare): guardrails against PHI appearing in agent output and unqualified medical advice, PHI redaction on input, and intent rules for bulk PHI export and a read-scoped task mutating patient data — mapped to HIPAA / HITECH / 45 CFR Part 164.
• DORA — Financial Services (dora-financial): guardrails against unlicensed financial advice and cardholder-data exposure and for prompt-injection resilience, and intent rules for bulk customer-financial-data export and unauthorized payment mutation — mapped to DORA / EU 2022/2554 / MiFID II / PCI-DSS.
• OWASP Agentic — Security Starter (owasp-agentic-2026): starter guardrails and intent rules plus ten risk-register entries mapped to the OWASP Top 10 for Agentic Applications (2026). The pack is explicit that it is a starting configuration, not a certification — installing it does not certify compliance or lower risk, and most of the ten mapped categories still need configuration and testing beyond what it installs.

No other packs exist in the product today, and authoring or publishing a pack from outside Praesidia is not available.

Before you start

• Governance packs require the AGENT_GOVERNANCE feature to be enabled on your organization; ask your administrator if the catalog isn't visible.
• Browsing the catalog and your installed packs requires the governance_packs.view permission (organization owner, compliance officer, and standard user roles). Installing a pack requires governance_packs.install (organization owner and compliance officer roles only).

1. Browse the catalog

In the workspace, go to Manage → Governance → Packs to see every available pack and whether it's already installed for your organization.

2. Install a pack

Select a pack and install it. Installation is idempotent — installing an already-installed pack re-applies its current definition rather than creating duplicate guardrails or intent rules.

3. Review and adjust

Everything a pack installs shows up in Guardrails and Policies alongside anything you configured yourself, and can be edited or removed like any other guardrail or rule. A pack's compliance mappings describe the risk categories its controls address; they don't replace your own risk register entries or an EU AI Act classification.

API

Next steps

• Configure guardrails directly
• Author policies
• Build a risk register entry
• Classify agents under the EU AI Act