AiGovernanceList

An allow or deny list of AI tools, MCP servers, skills or clients, stored as AI Firewall guardrails: one guardrail row per pattern, of rule type _. The list owns its rows, so removing a pattern removes its row. The same list can be written inline as AiFirewallPolicy spec.capabilities.

apiVersion	vulnetix.com/v1
kind	AiGovernanceList
Group	AI firewall
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists AiGovernanceList in its kinds. See Management tokens.
Terraform resource	vulnetix_ai_governance_list, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.157.0 and later.
Pinned schema	v1.15.0/AiGovernanceList.schema.json
Newest schema	latest/AiGovernanceList.schema.json
First released in	v1.1.0
Print the built-in copy	vulnetix config schema AiGovernanceList

Minimal

Only the fields the kind requires. From examples/AiGovernanceList/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/AiGovernanceList.schema.json
apiVersion: vulnetix.com/v1
kind: AiGovernanceList
metadata:
  name: deny-shell-tools
spec:
  family: tool
  list: deny
  action: block
  patterns:
    - Bash

HCL (resource vulnetix_ai_governance_list)

# Only the arguments the kind requires. From config-schemas examples/AiGovernanceList/minimal.yaml.

resource "vulnetix_ai_governance_list" "deny_shell_tools" {
  name     = "deny-shell-tools"
  action   = "block"
  family   = "tool"
  list     = "deny"
  patterns = ["Bash"]
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/AiGovernanceList.schema.json
apiVersion: vulnetix.com/v1
kind: AiGovernanceList
metadata:
  name: deny-shell-tools
spec:
  family: tool
  list: deny
  action: block
  patterns:
    - Bash
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/AiGovernanceList/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/AiGovernanceList.schema.json
apiVersion: vulnetix.com/v1
kind: AiGovernanceList
metadata:
  name: unapproved-mcp
  labels:
    team: platform-security
  annotations:
    ticket: https://tracker.example.com/SEC-2214
spec:
  family: mcp
  list: deny
  action: strip
  priority: 20
  enabled: true
  patterns:
    - "*-shell"
    - filesystem
---
apiVersion: vulnetix.com/v1
kind: AiGovernanceList
metadata:
  name: approved-skills
spec:
  family: skill
  list: allow
  action: flag
  priority: 100
  enabled: false
  patterns:
    - code-review
    - "acme-*"

HCL (resource vulnetix_ai_governance_list)

# Every argument the kind supports. From config-schemas examples/AiGovernanceList/advanced.yaml.

resource "vulnetix_ai_governance_list" "unapproved_mcp" {
  name     = "unapproved-mcp"
  action   = "strip"
  enabled  = true
  family   = "mcp"
  list     = "deny"
  patterns = ["*-shell", "filesystem"]
  priority = 20
  labels = {
    team = "platform-security"
  }
  annotations = {
    ticket = "https://tracker.example.com/SEC-2214"
  }
}

resource "vulnetix_ai_governance_list" "approved_skills" {
  name     = "approved-skills"
  action   = "flag"
  enabled  = false
  family   = "skill"
  list     = "allow"
  patterns = ["code-review", "acme-*"]
  priority = 100
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/AiGovernanceList.schema.json
apiVersion: vulnetix.com/v1
kind: AiGovernanceList
metadata:
  name: unapproved-mcp
  labels:
    team: platform-security
  annotations:
    ticket: https://tracker.example.com/SEC-2214
spec:
  family: mcp
  list: deny
  action: strip
  priority: 20
  enabled: true
  patterns:
    - "*-shell"
    - filesystem
---
apiVersion: vulnetix.com/v1
kind: AiGovernanceList
metadata:
  name: approved-skills
spec:
  family: skill
  list: allow
  action: flag
  priority: 100
  enabled: false
  patterns:
    - code-review
    - "acme-*"
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly AiGovernanceList	Always AiGovernanceList.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys	An allow or deny list for one AI capability family. Each pattern becomes one AI Firewall guardrail row of rule type _ (tool_deny, mcp_allow and so on). A deny always wins. Any enabled allow rule puts its family into allowlist mode, where everything it does not name is refused.
spec.family	string	yes		tool, mcp, skill, client	tool: a tool offered to the model. mcp: an MCP server wired into the session. skill: an agent skill. client: the calling client, named by its headers (claude-code, codex-cli).
spec.list	string	yes		allow, deny
spec.action	string	yes		block, flag, strip	block refuses the request. flag lets it through and records the match. strip removes the matched tool or MCP server and sends the rest of the request; it applies to the tool and mcp families only, because a skill is a value inside another tool and a client is a header.
spec.priority	integer	no	100	>= 0	Evaluation order among guardrails, lowest first.
spec.enabled	boolean	no	true
spec.patterns	array of string	yes		1 to any items; items unique; each item: pattern ^[^\^\s](.*[^$\s])?$; length 1 to any

Rules

Conditions the schema enforces beyond each field’s own type. vulnetix config validate and the engine’s plan report a document that breaks one.

On	Rule
spec	When family is one of skill, client: action must be block, flag.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How it is stored

Each pattern becomes one AI Firewall guardrail row of rule type <family>_<list> (tool_deny, mcp_allow and so on), owned by the list (configOwner = "AiGovernanceList/<name>"). Removing a pattern removes its row, and rows written in the console are never touched. AiFirewallPolicy spec.capabilities writes the same kind of rows, owned by the policy.

Terraform and OpenTofu

The resource is vulnetix_ai_governance_list in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_ai_governance_list.

Import an object that already exists by its name:

# Import an existing AiGovernanceList by its name (metadata.name).
terraform import vulnetix_ai_governance_list.deny_shell_tools deny-shell-tools

Install, authentication and how state is read: Terraform and OpenTofu.

More examples

examples/AiGovernanceList/deny-mcp.yaml from Vulnetix/config-schemas:

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/AiGovernanceList.schema.json
apiVersion: vulnetix.com/v1
kind: AiGovernanceList
metadata:
  name: unapproved-mcp
spec:
  family: mcp
  list: deny
  action: strip
  priority: 20
  patterns:
    - "*-shell"
    - filesystem

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.