> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coverbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Governor platforms

> Connect agents built on Microsoft Copilot Studio, Salesforce Agentforce and ServiceNow to the Agent Governor, so their actions are decided by policy, approved by a person when held, and recorded in the audit trail.

> [!TIP]
>
> Each platform has a step-by-step user guide: [Copilot Studio](https://docs.coverbase.com/user-guides/agent-governor-copilot-studio.md), [Agentforce](https://docs.coverbase.com/user-guides/agent-governor-agentforce.md) and [ServiceNow](https://docs.coverbase.com/user-guides/agent-governor-servicenow.md).

Agents built on an enterprise platform reach the [Governor](https://docs.coverbase.com/products/agent-governor.md) through a connector for that platform. Each connector is a thin layer over the governor's runtime API: the platform's agent asks the governor before it touches a database or an API, the governor decides, runs the action with a credential scoped to it, masks the result and records it. The platform never holds the target's credential.

| Platform | What you install | What the agent gets |
| - | - | - |
| [Copilot Studio](#copilot-studio) | A Power Platform custom connector | Actions to run a governed SQL query, send a governed API request, check an approval and list targets |
| [Agentforce](#agentforce) | A Salesforce package of Apex actions | Run governed action, Check governed approval and List governed targets |
| [ServiceNow](#servicenow) | A scoped app | The Governed Data Agent in AI Agent Studio, and a script include for flows and scripts |

## Before you start

1. In **Inspect › Governor › Agents**, select **Register agent** and name it after the platform agent, for example `copilot-studio-hr`. One governor agent per platform agent keeps the audit trail readable.
2. Copy the key. The **Connect an agent** panel shows it once. Under **Platform**, pick your platform to see its setup and a link back to this page.
3. Give the agent a baseline on the targets it should reach. An agent sees, and can act on, only the targets a baseline lets it reach.

## Copilot Studio

The connector also works in Power Automate and in agent flows.

1. Get the connector files, `apiDefinition.swagger.json` and `apiProperties.json`, from your Coverbase contact.
2. Import them with the Power Platform CLI, or in the maker portal under **Custom connectors › New custom connector › Import an OpenAPI file**:

```bash theme={null}
pac connector create --api-definition-file apiDefinition.swagger.json --api-properties-file apiProperties.json
```

3. Create a connection. Enter the key as `Bearer cbbk.<agent_id>.<secret>`, with the word `Bearer` and a space in front. Power Platform does not let a connector set its own authorization header, so the connection carries the whole value.
4. In Copilot Studio, open the agent and select **Tools › Add a tool › Connector**, then add **Run a governed SQL query** (or **Send a governed API request**) and **Get approval status**.
5. Under the tool's **Credentials to use**, pick **Maker-provided credentials** so every user acts as the one governor agent.
6. Add this to the agent's instructions: "When a Coverbase action returns hold, tell the user that a person must approve it and give them the note. When they ask again, check Get approval status, and once it is approved run exactly the same action again with the approval ID. When it returns deny, do not retry."

The **Target** field is a list filled from the targets the agent may reach, so a maker picks a target by name.

### Acting for many people

A connection holds one agent key. With **Maker-provided credentials**, every user acts as one governor agent. With **End user credentials**, each person signs in with their own key and acts as their own governor agent. To keep one agent and still record the person, pass their delegation in the **Delegation ID** input that every action takes, for example from a Dataverse table keyed by the user's `System.User.Id`. The governor records the person beside the agent and limits the agent to that person's delegated targets.

### Unattended flows

For an unattended flow, call the action and, when the verdict is `hold`, loop with **Do until** the approval status is not `pending`: **Get approval status**, then a 30 second delay. On `approved`, call the same action with the approval ID. On `denied` or `expired`, stop and report the note.

## Agentforce

1. Get the Salesforce project from your Coverbase contact and deploy it:

```bash theme={null}
sf project deploy start --target-org <your-org> --test-level RunSpecifiedTests --tests CoverbaseGovernorTest
```

2. In Salesforce Setup, open **Named Credentials › External Credentials › Coverbase Agent Governor**, open the `Agent_Key` principal, and add an authentication parameter named `AgentKey` with the key as its value, without `Bearer`.
3. Assign the **Coverbase Agent Governor User** permission set to the agent's running user and to anyone who runs the actions in an employee agent.
4. In Agent Builder, open your agent and select **Topics › Add from Asset Library**, then add **Governed Company Data**. The package ships the topic and its three actions (**Run governed action**, **Check governed approval** and **List governed targets**) with instructions for each verdict. To use an existing topic instead, add the three actions from **Asset Library › Actions**.

The topic and actions deploy only to an org with Agentforce turned on.

An Apex action cannot wait, so a held action is conversational: the agent tells the user, and runs the same action with the approval ID once **Check governed approval** returns `approved`. A scheduled or record-triggered flow can do the same check for unattended work.

To give each person their own key, assign the **Coverbase Governor Per User** permission set instead. Each person then opens **Settings › External Credentials › Coverbase Agent Governor** and stores their own key in an `AgentKey` parameter on the `Per_User` principal. A person without a stored key gets an authentication error instead of acting as the shared agent. To keep one shared key and still record the person, pass a delegation ID to **Run governed action**.

To use a non-production Coverbase environment, change the named credential URL to `https://api.<env>.coverbase.app`.

## ServiceNow

1. Get the scoped app source from your Coverbase contact, then build and install it with the ServiceNow SDK:

```bash theme={null}
npm install
npm run build
npx now-sdk auth --add https://yourinstance.service-now.com --type basic
npm run deploy
```

2. Store the key. In **Connections & Credentials › Connection & Credential Aliases**, create a credential alias in the app's scope, create an API Key credential holding the key, and put the alias's sys\_id in the `x_cbase_governor.credential_alias` system property. Or set the encrypted `x_cbase_governor.agent_key` property.
3. Grant the `x_cbase_governor.user` role to the people who use the agent and to the agent's run-as user.
4. Open **AI Agent Studio › Create and manage › AI agents › Governed Data Agent**. It comes with three tools and instructions for each verdict. **Run governed action** asks a person in the conversation to confirm each call; the two read tools run on their own.

From a script or a flow, call the script include:

```javascript theme={null}
var outcome = new x_cbase_governor.CoverbaseGovernor().runAction({
    targetId: 'cbbtgt_...',
    kind: 'sql',
    sql: 'SELECT id, total FROM invoices WHERE paid = false'
});
```

`outcome.verdict` is `allow`, `hold` or `deny`. On `hold`, keep `outcome.approvalId` and run the same action again with it once the approval reads `approved`.

In Flow Designer, the app adds two actions, **Run Governed Action** and **Check Governed Approval**, and a subflow, **Run Governed Action and Wait for Approval**, in the **Coverbase Agent Governor** category. The subflow runs the action and, when it is held, checks the approval every minute until a person decides, then runs the identical action again with the approval ID.

Two system properties let each person act as themselves, and both are off by default. With `x_cbase_governor.per_user_credentials` on, each caller's own credential alias holds their key, and a caller without one is refused. With `x_cbase_governor.use_user_delegation` on, a call that names no delegation uses the caller's own delegation ID.

## Held actions on every platform

The governor pages its approvers when a policy holds an action, and the platform agent tells its user. **Approve once** runs only the exact statement or request the approver saw, so the agent must run exactly the same action again with the approval ID. A different statement is held again with a new approval ID, and the note says why. **Approve equal actions for** a window covers any statement of the same shape until it closes.

## Publishing status

The connectors are built and tested outside a live tenant. Before customers can install them from a marketplace, Coverbase completes each platform's listing: Microsoft connector certification as a verified publisher, the AppExchange security review for a managed package, and ServiceNow Store certification. Until then, your Coverbase contact gives you the files to install directly.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.