Governance Hub

Where to Find It

In the app: left navigation → Governance Hub (/governance). Tabs are selected with ?tab=systems, reviews, incidents, evidence, audit, fria (EU module only), or hipaa (HIPAA module only).

Org-level compliance toggles (region, EU AI Act module, HIPAA module) live under Settings → Compliance (/settings?section=compliance), linked from the Hub header. Data residency and subprocessors: Trust Center.

Summary Bar

Four cards at the top of the Hub. Each links to the relevant tab.

Hub Tabs

When the EU AI Act module is off, the FRIA tab is hidden. Core tabs remain available.

Access Control

Org admins typically have both permissions.

AI Systems Registry

One registry row per AI product or workflow your organization documents for auditors, whether Traccia monitors it or not.

• Fields you set in the UI: name, intended purpose, risk tier (minimal / limited / high), linked Traccia agent slugs, optional third-party vendor and product
• Deployment type (derived automatically): Traccia agents only, third-party only, hybrid (both), or registry entry with no links
• Agent linking: pick from agents in your currently selected workspace when registering. Multiple agents can link to one system
• Decommission: removes the registry row. Linked reviews, incidents, and FRIA assessments keep their history; the ai_system_id link is cleared (database ON DELETE SET NULL)
• EU module on: amber retention warning when risk tier is high and your plan retains traces for fewer than 180 days (warning only; does not block ingestion). Provider doc downloads appear on each system card

Reviews Workflow

Human sign-off on a specific automated run. Each review requires a trace ID so auditors can open the exact run in Traces.

1. Open a trace in Traces → copy the trace ID
2. Governance Hub → Reviews → enter trace ID (optional AI system link)
3. Pending tab: reviewer clicks Review → Approve or Reject with optional comment
4. Completed tab: shows decision, reviewer name, resolved time, activity comments
5. Return to queue: reopens a completed item to pending (comment required)
6. Add comment: append notes on completed items without changing the decision

Reviews are platform-only. The Python SDK does not create review queue rows. See EU AI Act guide for how this relates to Art. 14 human oversight evidence when the EU module is on.

Incidents Workflow

Internal record of AI-related harm, near-misses, outages, or policy breaches. Not a government filing. Serious EU cases may still require official authority notification outside Traccia.

• Taxonomy: serious incident, near miss, systemic risk, other
• Severity: low, medium, high, serious
• Optional fields: description, linked AI system
• Close: optional closing note; records who closed and when
• Reopen: required comment explaining why the case is active again
• Activity comments are appended to the incident record and included in audit exports (when the incident falls within the export sample window)

Evidence Pack Contents

Governance Hub → Evidence downloads a single JSON file with an integrity hash. Choose standard or EU-labeled export (EU option visible only when the EU module is on).

• AI systems: full registry snapshot (name, purpose, risk tier, linked agents)
• Policy violations: count only (policy_violations_count). No individual violation payloads
• Admin audit events: total count plus up to 50 rows in audit_events_sample (action, resource type, resource id, timestamp). Backend queries up to 500; export includes the first 50
• Review requests: total count plus up to 50 rows in review_requests_sample (status, decision, reviewer id, trace id). Backend queries up to 200; export includes the first 50
• Incidents: total count plus up to 20 rows in incidents_sample (title, severity, status, taxonomy). Backend queries up to 100; export includes the first 20
• EU bundle only: eu_ai_act_article_mapping labels and disclaimer string

The bundle does not include raw trace payloads or span-level inference logs. Requires settings:read or org admin.

Audit Log Tab

Read-only table of recent admin activity. The UI loads the latest 200 events (API cap 500). There are no filter controls in the app today.

Labeled event types include:

• Compliance settings changes (region, EU module toggle)
• AI system registered, updated, or removed
• Review requested or decided
• Incident opened or updated
• Evidence pack exported
• Policy created, updated, or deleted
• API key created or revoked

This is org admin activity, not per-end-user access logs or inference audit trails. Those live in your trace data and application logs.

Policies vs Governance Hub

These are separate workflows with different jobs:

See Policies for rule configuration.

Retention and Purge

Trace spans and trace batches are purged per workspace by a background job based on billing-plan retention (or workspace override, default 90 days). This affects Traces views and span-level evidence, not the governance tables below.

• Legal hold: when enabled on a workspace, purge skips that workspace entirely
• Governance data retained: AI system registry, review requests, incidents, FRIA assessments, and audit events are stored in separate tables and are not purged by the trace retention job
• Deletion certificates: when purge runs, the server writes a deletion_certificates row per workspace (record count, cutoff timestamp, content hash). There is no Hub UI for these today; they exist for backend audit evidence
• EU retention warning: compares your high-risk registry tag against workspace retention days. Does not extend retention automatically

Plan retention days are defined in your contract / billing tier. See the Trust Center for tier details.

SDK — trace evidence and runtime policy

Use observe for tracing on any OTLP backend. Use govern when you need runtime policy enforcement against the Traccia platform (requires API key + endpoint). Human review, incidents, and registry work stay in the Hub.

from traccia import init, observe, govern
from traccia.governance import disclosure

init(api_key="...", endpoint="https://api.traccia.ai/v2/traces")

@observe()
def chat(user_msg: str) -> str:
    disclosure(channel="ui", disclosed_to_user=True)
    return run_llm(user_msg)

@govern(agent_id="my-agent", fail_open=False)
def regulated_run(prompt: str) -> str:
    return run_llm(prompt)

Optional: init(redact_pii=True) / redactPii: true for regex-based masking. Full reference: Python SDK API, TypeScript SDK API, and Governance guide.

EU AI Act Module

Opt-in under Settings → Compliance. When on, the Hub shows the FRIA tab, EU-labeled evidence exports, provider documentation downloads on system cards, and EU article references in review copy. When off, core Hub tabs work with neutral language. Full setup and article mapping: EU AI Act Compliance.

HIPAA Module

Opt-in under Settings → Compliance (can be enabled together with the EU AI Act module). When on, the Hub shows the HIPAA tab (?tab=hipaa): safeguards checklist with agent / third-party inventory, customer vendor BAA inventory, and a Contact Traccia CTA (emails support@traccia.ai). AI systems gain PHI flags, optional PHI categories, soft warnings, and HIPAA-labeled evidence exports that include safeguard drafts and vendor rows. Traccia does not certify HIPAA compliance and does not currently offer a signed BAA. Shared responsibility: Trust Center. Full guide: HIPAA Controls for AI Agents.