wm_govern
Check if an AI action is permitted by workspace policy before execution. Unknown actions are denied; sensitive writes require preview or named approver; every decision is journaled.
Instructions
Check whether an AI action is allowed by the workspace policy without performing it. Unknown actions are denied by default. Write actions can require a preview, and sensitive actions can require a named human approver. The decision is recorded in the hash-chained journal.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| paths | No | ||
| action | Yes | Action to check: read, write, execute, delete or network. | |
| preview | No | ||
| approver | No |