Governance

The Governance section in Novantra covers everything an organization uses to decide what should be done, prove it’s been done, and demonstrate it to anyone who asks. Controls, risks, evidence, assessments, findings, exceptions, monitoring, indicators, assurance engagements, regulator submissions, access governance, retention - they all live here.

Modules

The governance foundation is built as 34 composable modules, organized into five tiers from foundation concepts (frameworks, scope, evaluation models) up through operational domains (assets, vulnerability management, cryptography, privacy, resilience).

See Modules for the full catalogue with tier-by-tier breakdown.

AI Governance

A dedicated suite for governing AI use in the workspace: registered AI systems, use authorizations, provider connections, Copilot profiles, Document Intelligence, action policies, and the full audit trail of AI activity.

See AI Governance for the complete set of pages.

Governed Automation

A cross-cutting orchestration suite for declarative automations that react to triggers, evaluate conditions, and invoke safe actioners owned by other governance modules. Includes triggers, the actioner catalogue, and audit-grade run evidence.

See Automation for the four pages.

Party Governance

The end-to-end story of how your organization governs external parties — customers, suppliers, applicants, beneficiaries — through party types, lifecycles, eligibility, public sessions, forms, responsibilities, and review-approval. Eight composable modules.

See Party Governance for the deep-dive pages.

Trace and Lineage

A cross-cutting layer that surfaces relationships between governed records (trace) and the upstream provenance of records imported from a catalogue (lineage). Useful when an auditor asks “what touches this record” or “where did this template come from.”

See Trace & Lineage for the deep dives.

Workspace governance - the coordination hub for forms, responsibilities, party lifecycles, and party eligibility inside a single organization.
Classification - the sensitivity levels you define for the data your organization handles.
Cross-organization governance - the model for a Sovereign install hosting multiple organizations (headquarters and subsidiaries) and how policies travel between them.

What governance is not

Two scoping clarifications, because the words overlap with adjacent concepts.

Governance is not pre-built framework content

You can register frameworks you operate under (ISO 27001, NIST, SOC 2, FINMA, NIA, NCA, internal policies, etc.) using the Frameworks module, version them, and link coverage to controls and evidence. What Novantra does not yet ship is pre-built framework packs that arrive populated with all of a framework’s controls and requirements. That’s a separate feature called the Framework Catalog and is on the roadmap.

In the meantime, you register the frameworks your organization actually uses, with the requirement nodes and coverage links that matter to you. This is enough to drive controls, risks, evidence, and assessments today. Pre-seeded catalog packs will reduce the manual setup work when they ship.

Governance is not workspace administration

The lines blur. The general rule:

Workspace administration is who can sign in, what role they hold, and the audit log of their actions - see Workspace administration.
Workspace governance is what the workspace is supposed to do and who is responsible for it.

If a setting answers “who has the permission”, it’s administration. If it answers “what policy applies”, it’s governance.

Cloud and Sovereign

The governance modules work the same way in Cloud and Sovereign. The only structural difference is that cross-organization governance is Sovereign-first because it presumes a single install hosting multiple organizations.

Looking for the API?

Each module also has REST API documentation under Developers → REST API → Governance.