Governance Engine
Protection rules that gate skill publication and enforce review requirements.
The Governance Engine controls who can publish skills, what review requirements apply, and how the quality bar is enforced before a skill reaches your organization's library.
Protection Rules
Protection rules are configured at the org level and can be overridden per skill. They gate the publish flow — a skill version cannot be published until all applicable rules pass.
| Rule | Description | Default |
|---|---|---|
requiredReviewers | Minimum number of approvals before a version can be published | 1 |
allowSelfPublish | Whether the skill author can approve and publish their own work | false |
reviewerNotAuthor | Requires at least one reviewer to be someone other than the author | true |
requireSampleRun | A sample run must be recorded before the version can be submitted | false |
requireOutcomeHook | An outcome hook must be configured on the skill | true |
reviewerPool | Restrict reviewers to a specific team (null = any member) | null |
Configuring Rules
Navigate to Settings > Skills to view and update org-level protection rules. To override rules for a specific skill, go to Skills > [slug] > Settings.
Rules can also be managed via the API:
# Get current org rules
curl -H "Authorization: Bearer hw_..." \
https://api.headways.ai/v1/orgs/me/protection-rules
# Update a rule
curl -X PUT -H "Authorization: Bearer hw_..." \
-H "Content-Type: application/json" \
-d '{"requiredReviewers": 2, "allowSelfPublish": false}' \
https://api.headways.ai/v1/orgs/me/protection-rulesAudit Trail
Every lifecycle event — submit, approve, reject, publish — is recorded in the org activity log. Access it at Settings > Activity or via the API at GET /v1/orgs/me/activity.