You are here:
Governance Rules
Each Governance policy is made up of rules. Rules define the specific behavior that Lifecycle Center Governance enforces for coding agents.
Rules are the building blocks of governance policies. Each rule targets a specific risk in AI-assisted development and defines the standard that coding agents must follow when writing code, running commands, or making changes in your org.
While policies group related standards by category—such as Security or Quality—rules are where enforcement actually happens. A rule is precise: it describes one risk, what triggers a violation, and what the compliant alternative is. This specificity is what allows Governance to give coding agents clear, actionable guidance at the point of action rather than generic restrictions.
All rules are enabled by default when you activate Governance. You can enable, disable, or set individual rules to shadow mode to tailor enforcement to your org's priorities—without disabling entire policy categories.
What a rule contains
Each rule includes the following information:
- Name—a short label that identifies the standard, such as No SOQL/SOSL Injection or Enforce CRUD/FLS Checks.
- Description—an explanation of the risk the rule addresses and why it matters in the context of AI-assisted development.
- Category—the policy category the rule belongs to, such as Security or Quality.
- What it prevents—the specific action or pattern that triggers a violation, such as dynamic queries that concatenate unsanitized user input.
- Recommended alternative—the compliant approach the coding agent should use
instead, such as bind variables or
String.escapeSingleQuotes(). - Status—whether the rule is enabled, disabled, or in shadow mode.
Rule states
| State | Behavior |
|---|---|
| Enabled | The rule is active. Governance evaluates coding agent actions against it and prevents violations in real time. |
| Disabled | The rule is inactive. Governance doesn't evaluate or enforce it. |
| Shadow | The rule runs in monitoring mode. Governance logs its violations without preventing coding agent actions, so you can assess impact before switching it to full enforcement. |
- Rule Enforcements
Each Governance rule maps to an enforcement that checks coding agent activity against that rule. - Shadow Mode for Rules
Set a rule to shadow mode to see how it would affect coding agents before you enforce it. - Update Rule Status
Turn a rule on or off, or set it to shadow mode, to control how it's enforced for coding agents.
