Overview

The governance agents live in backend/app/agents/ and run as Celery tasks. They are triggered directly by platform events — no polling and no separate process to run. Each agent uses the platform's own LLM gateway for reasoning, so all agent LLM calls appear in workspace usage metrics and go through safety screening.

Agent	Trigger	Value
`CompliancePipelineAgent`	Model registered	Auto-evaluates all applicable frameworks; promotes or blocks with an approval request
`IncidentResponseAgent`	Drift / robustness / bias event	Notifies Slack, creates JIRA ticket, pages on-call if critical
`GovernanceReportingAgent`	Celery Beat — Monday 07:00 UTC	Board-ready weekly compliance summary across all workspaces
`RemediationSuggestionAgent`	Regulatory eval fails	Generates control-specific, effort-estimated remediation steps via LLM

CompliancePipelineAgent

Triggered automatically after POST /api/v1/registry/models. The agent selects applicable frameworks from workspace metadata (jurisdiction, industry) and model metadata (task_type, tags), then runs all evaluations in parallel. If every framework passes, the model is automatically promoted. If any fail, a HITL approval request is created for the legal role with a summary of failing controls.

text

Framework selection rules

1eu_ai_act    — always applied
2nist_ai_rmf  — always applied
3dora         — workspace jurisdiction contains "eu" or "uk"
4mas_trmg     — workspace jurisdiction contains "sg" or "apac"
5sr_11_7      — workspace industry contains "finance" or "banking"
6hipaa_fda    — model task_type contains "clinical" or "medical"
7sox_sec      — workspace industry contains "public_company" or "finance"

IncidentResponseAgent

Triggered by four webhook events: drift.detected, robustness_eval.failed, bias_eval.failed, and model.promotion_blocked. The agent fetches the full report, uses the LLM to write a structured incident summary, then notifies the configured channels. PagerDuty paging is only triggered when severity is critical.

bash

Notification channel env vars

1AGENT_SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...
2AGENT_JIRA_BASE_URL=https://yourcompany.atlassian.net
3AGENT_JIRA_API_TOKEN=...
4AGENT_JIRA_PROJECT_KEY=MLOPS
5AGENT_JIRA_EMAIL=service@yourcompany.com
6AGENT_PAGERDUTY_KEY=...   # critical-only paging

Event	Severity classification
`drift.detected`	`critical` if platform severity=critical, else `high`
`robustness_eval.failed`	`critical` if robustness_score < 0.40, else `high`
`bias_eval.failed`	`critical` if disparate_impact_ratio < 0.60, else `high`
`model.promotion_blocked`	`high`

GovernanceReportingAgent

Runs every Monday at 07:00 UTC via Celery Beat. Iterates all workspaces, collects compliance scores, framework pass rates, and regulatory artifact counts. Identifies models whose compliance score has dropped more than 10 percentage points in the past 30 days. Passes all data to the LLM to generate an executive summary, then stores the report as an audit event and fires a governance_report.ready webhook for downstream consumers (email, Confluence, etc.).

bash

Trigger manually

1# Run immediately for a specific workspace
2celery call run_governance_report --args='[["ws-prod"]]'
3
4# Run for all workspaces (default)
5celery call run_governance_report

RemediationSuggestionAgent

Triggered automatically when a regulatory evaluation is marked failed in tasks.py. Fetches the failing controls and model card, then prompts the LLM with the specific regulatory text for that framework to generate control-by-control remediation steps. Each step includes a priority (critical/high/medium), effort estimate (S/M/L), specific actions, and the relevant article reference. Steps are attached to the evaluation record via POST /api/v1/regulatory/evaluations/{id}/remediations.

json

Remediation output example

1[
2  {
3    "control_id": "EU_AI_ACT_ART9",
4    "control_name": "Risk management system",
5    "priority": "critical",
6    "effort": "L",
7    "steps": [
8      "Create a risk register document covering all identified risks for this model",
9      "Implement residual risk acceptance sign-off by the model owner",
10      "Schedule quarterly risk review cadence and assign DRI"
11    ],
12    "regulatory_reference": "EU AI Act Art. 9 — risk management system lifecycle"
13  }
14]

Agent Configuration

All agents authenticate to the platform API using a machine-to-machine PAT. Set AGENT_API_KEY to a PAT with the ops role. The AGENT_LLM_MODEL controls which model the agents use for reasoning — defaults to gpt-4o-mini for cost efficiency.

Variable	Required	Description
`AGENT_API_KEY`	Yes	PAT with `ops` role for internal API calls
`AGENT_LLM_MODEL`	No	LLM model for agent reasoning (default: `gpt-4o-mini`)
`AGENT_SLACK_WEBHOOK_URL`	No	Slack incoming webhook URL for incident notifications
`AGENT_JIRA_BASE_URL`	No	JIRA instance base URL (e.g. `https://company.atlassian.net`)
`AGENT_JIRA_API_TOKEN`	No	JIRA API token for ticket creation
`AGENT_JIRA_PROJECT_KEY`	No	JIRA project key (default: `MLOPS`)
`AGENT_PAGERDUTY_KEY`	No	PagerDuty Events API v2 routing key for critical paging