Each Governance policy is made up of rules. Rules define the specific behavior that Lifecycle Center Governance enforces for coding agents.
Rules are the building blocks of governance policies. Each rule targets a specific risk in AI-assisted development and defines the standard that coding agents must follow when writing code, running commands, or making changes in your org.
While policies group related standards by category—such as Security or Quality—rules are where enforcement actually happens. A rule is precise: it describes one risk, what triggers a violation, and what the compliant alternative is. This specificity is what allows Governance to give coding agents clear, actionable guidance at the point of action rather than generic restrictions.
All rules are enabled by default when you activate Governance. You can enable or disable individual rules to tailor enforcement to your org's priorities.
What a rule contains
Each rule includes the following information:
- Name—a short label that identifies the standard, such as No SOQL/SOSL Injection or Enforce CRUD/FLS Checks.
- Description—an explanation of the risk the rule addresses and why it matters in the context of AI-assisted development.
- Category—the policy category the rule belongs to, such as Security or Quality.
- What it prevents—the specific action or pattern that triggers a violation, such as dynamic queries that concatenate unsanitized user input.
- Recommended alternative—the compliant approach the coding agent should use
instead, such as bind variables or
String.escapeSingleQuotes(). - Status—whether the rule is enabled or disabled.
Rule states
| State | Behavior |
|---|---|
| Enabled | The rule is active. Governance evaluates coding agent actions against it and prevents violations in real time. |
| Disabled | The rule is inactive. Governance doesn't evaluate or enforce it. |
- Rule Enforcements
Each Governance rule maps to an enforcement that checks coding agent activity against that rule. - Update Rule Status
Turn a rule on or off to control how it's enforced for coding agents.