Configuration

Configuration Sources

Boot configuration comes from environment variables; everything else is managed through the settings control plane at runtime. This split keeps secrets out of the runtime store while keeping operational tuning auditable.

Environment Variables

AI_GOVERNANCE_DATABASE_URL=postgres://...
AI_GOVERNANCE_GRAPH_URL=bolt://...
AI_GOVERNANCE_OTEL_ENDPOINT=http://collector:4317
AI_GOVERNANCE_LOG_LEVEL=info

# Durable Replay Management
AI_GOVERNANCE_REPLAY_REPOSITORY=sqlite
AI_GOVERNANCE_REPLAY_SQLITE_PATH=/var/lib/ai-governance/governance.db
AI_GOVERNANCE_REPLAY_EXECUTION_CATALOG_BACKEND=sqlite
AI_GOVERNANCE_REPLAY_EXECUTION_CATALOG_SQLITE_PATH=/var/lib/ai-governance/governance.db
AI_GOVERNANCE_REPLAY_EVALUATION_PROVIDER=mock
AI_GOVERNANCE_RUN_REPLAY_WORKER=false
AI_GOVERNANCE_WORKER_POLL_SECONDS=1
AI_GOVERNANCE_WORKER_LEASE_SECONDS=300

OAuth Client Credentials

AI_GOVERNANCE_OAUTH_* is the generic confidential-client interface for AI Governance Platform workloads. The guided walkthrough and its release smoke test exchange these credentials for a short-lived token in memory; they do not require a manually exported bearer token.

AI_GOVERNANCE_OAUTH_TOKEN_URL=https://keycloak.example/realms/ai-governance/protocol/openid-connect/token
AI_GOVERNANCE_OAUTH_CLIENT_ID=ai-governance-walkthrough
AI_GOVERNANCE_OAUTH_CLIENT_SECRET=loaded-from-a-secret-manager

Local ./servers.sh startup writes the configured development client to .env.oauth.generated. The file is ignored by Git and loaded automatically by ai-governance walkthrough. The generic scripts/oauth/fetch-access-token.py --clipboard helper is for a local tool that genuinely needs a token pasted into another client; the walkthrough itself does not need it.

Common Keys

• evaluation.parallelism — max concurrent evaluations.
• jobs.retry.max_attempts — retry budget per job.
• replay.evaluation.max_attempts — retry budget for the separate replay-evaluation job.
• replay.drift.threshold_policy — thresholds applied when replay evidence is compared with a compatible source baseline.
• projection.reconcile_interval — graph reconciliation cadence.
• audit.retention_days — audit log retention window.

Precedence

Runtime settings resolve environment over tenant over system scope. Environment variables apply only to boot-time concerns such as datastore connections and cannot override runtime governance settings.