Data Governance
Data Governance helps you discover and control sensitive data moving through the Cequence AI Gateway. The gateway scans AI traffic, identifies sensitive data with detectors, and applies the policies you configure before the traffic continues.
At a high level, it works in three steps: detectors recognize a type of sensitive data → you combine detectors into a policy with one of three actions (monitor, redact, or block) → you apply that policy to the MCP servers or Agent Personas you want to protect.
You can use Data Governance to:
- Detect credentials, financial data, health information, personal identifiers, and other sensitive data
- Monitor findings without changing traffic
- Redact matched values before they reach their destination
- Block requests that violate policy
- Apply policies to selected MCP servers or attach them directly to an Agent Persona
- Review live decisions, compliance posture, and risks
Quick Start: What do you want to do?
| I want to... | Go to |
|---|---|
| Understand detectors, coverage areas, and policies | How it works (below) |
| Configure Data Governance for the first time | Set up Data Governance |
| See what sensitive data can be detected | Detectors |
| Create a policy | Policies |
| Choose between monitor, redact, and block | Enforcement modes |
| Protect one Agent Persona everywhere it operates | Attach a policy to a persona |
| Investigate findings and policy decisions | Monitor and investigate |
| Turn Data Governance scanning on or off | Settings |
| Fix a policy that is not behaving as expected | Troubleshooting |
How Data Governance Works
Data Governance has four main parts:
| Part | What it does |
|---|---|
| Coverage area | Groups related detectors, such as financial, healthcare, secrets, or government identifiers |
| Detector | Recognizes one type of sensitive data, such as a credit card number, API key, email address, or medical record number |
| Policy | Defines which detectors matter, where the policy applies, and what action the gateway takes |
| Decision | The result of evaluating traffic: allow and record, redact, or block |
When protected traffic reaches the gateway:
- The gateway identifies the MCP server, Agent Persona, tool, API, or model involved.
- It determines which enabled Data Governance policies apply.
- The data governance engine scans the relevant content with the selected detectors.
- Matching policies are evaluated.
- The strongest applicable action is enforced: Block takes precedence over Redact, which takes precedence over Monitor.
- The decision and its detector findings are recorded for investigation and audit.
Policies can govern both data entering an AI workflow and data returning from it. A policy attached to an Agent Persona follows that persona across every tool, API, and model it calls.
Where a policy applies
You decide the scope of every policy. A policy can apply to:
- Specific MCP servers — it inspects traffic to those servers, no matter which agent makes the call.
- A specific Agent Persona — it follows that persona across every tool, API, and model it uses, wherever the persona operates.
- Both — scope a policy to specific servers and attach it to a persona; it applies whenever either one matches.
Policies are always scoped to the servers or personas you choose. There is no single "apply to everything" switch — keeping coverage explicit makes it easier to review, test, and audit.
Detection methods
The detector catalog can include several detection methods:
- Text patterns for known formats and keywords
- Context-aware patterns that increase confidence when nearby words support a match
- Checksum validation for structured identifiers such as payment cards and other check-digit formats
- Composite detection for sensitive classes that require multiple findings to occur together
- AI-detected entities for context-defined sensitive information
The exact detector inventory comes from the active catalog version for your tenant. Use the Detectors page to see the current list rather than relying on a fixed list in documentation.
Recommended Rollout
- Enable Data Governance. See Settings.
- Run the setup wizard to select organization-specific coverage.
- Keep initial policies in Monitor while collecting representative traffic.
- Review the Overview and Tool Activity for false positives and gaps.
- Add narrow exceptions for known-safe values or contexts.
- Move validated policies to Redact or Block based on business impact.
- Attach persona-specific policies when a protection requirement should follow an agent across all of its tools, APIs, and models.
- Review coverage and recommendations regularly as your AI applications and compliance obligations change.
Cequence AI Gateway