> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kelasa.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Governance

> Approvals, roles, policy, and audit on every agent action

Agents are only useful in an enterprise if you can control what they do.
Governance in Kelasa isn't a report you read after the fact — it sits **in the
execution path**: every side-effecting action passes safety and policy checks
before it runs, and everything leaves an audit trail.

## The layers

<Steps>
  <Step title="Emergency controls">
    Workspace-level kill switches checked before anything else. If something
    goes wrong, stop agent activity immediately — no deploy, no support
    ticket.
  </Step>

  <Step title="Policy">
    Workspace policies decide whether a given tool action is allowed, requires
    approval, or is denied — evaluated at a single enforcement point every
    action must pass, whether it came from the assistant, a skill, or a
    workflow.
  </Step>

  <Step title="Confirmation and approvals">
    Side-effecting assistant actions pause for explicit confirmation.
    Workflow steps and skill runs can require approval from someone with the
    right role — granted in the web app or from a Slack card. See
    [Approvals](/guides/approvals).
  </Step>

  <Step title="Audit">
    Runs, deliveries, approvals, and policy decisions are recorded — who asked
    for what, what was approved, what ran, and what it did.
  </Step>
</Steps>

## Roles and access

Workspace members are **admins** or **members**. Admins manage people,
integrations, policies, and settings. By default, only admins can run
side-effecting capabilities through the assistant; a workspace setting extends
that to all members when you're ready.

## Data controls

Workspaces have data-retention controls, and secrets used by workflows are
encrypted at rest and never shown back once saved.