wm_govern
Check an AI action against workspace policy before executing. Default-deny unknown actions; writes may require preview, sensitive actions need a named approver; decisions go to a hash-chained journal.
Instructions
Check whether an AI action is allowed by the workspace policy without performing it. Unknown actions are denied by default. Write actions can require a preview, and sensitive actions can require a named human approver. The decision is recorded in the hash-chained journal.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| paths | No | ||
| action | Yes | Action to check: read, write, execute, delete or network. | |
| preview | No | ||
| approver | No |