otaExecution governance for humans and AI agents.
Get startedGitHub

Module 05

Governance

Understand Ota's governance model: policy packs, refusal canaries, boundary crossings, sandbox enforcement, and the distinction between what Ota enforces natively vs what requires an adopted chokepoint.

Intermediate3 lessons · ~26 min
Start with first lesson

Module curriculum

Lessons in Governance

Follow the sequence to build the model, then use the exercises to test the boundary.

Lesson 019 min read

Policies, refusals, and canaries

Policies define what is permitted. Refusals are the enforced rejections. Canaries prove that refusals actually fire when they should.

  • Write a policy that refuses a named task for agents
  • Describe what a refusal canary tests
IntermediateOpen lesson
Lesson 0210 min read

Crossings and sandbox enforcement

Crossing authority admits one exact governed operation; sandbox enforcement applies provider-bounded runtime controls to the selected lane.

  • Distinguish crossing authority from sandbox enforcement
  • Explain why a grant cannot widen or bypass agent admission
AdvancedOpen lesson
Lesson 037 min read

What Ota can enforce vs what requires a chokepoint

Ota enforces within its execution scope. Anything outside — provider policy, shell orchestration, external systems — requires an adopted chokepoint to be enforceable.

  • List three things Ota can enforce natively
  • List three things that require an external chokepoint
AdvancedOpen lesson