Prompt Governance

Prompt Governance

Prompt governance prevents production AI behavior from being hidden in page handlers or ad hoc strings.

Recommended Prompt Model

Each governed prompt should have:

• stable prompt code
• purpose
• immutable semantic version
• template
• input schema
• approval status
• change notes

Rendering Pattern

$response = $gateway->infer(new InferenceRequest(
    input: '',
    promptCode: 'control-summary',
    variables: [
        'control_name' => 'Access Governance',
        'evidence_notes' => $notes,
    ],
));

The gateway resolves the requested version, or the latest approved semantic version when no version is supplied, then validates variables and renders the template inside the audited boundary.

Operational Guidance

• Treat prompts as controlled application assets.
• Version prompts when behavior changes.
• Do not mutate approved prompt versions.
• Require approved state in governed mode.
• Validate required variables before provider execution.
• Keep human-readable purpose and review notes.
• Do not mix secrets into prompt templates.
• Capture prompt code and version in audit evidence.

The in-memory registry supports development and tests. The RAD PDO registry provides workspace-specific persistence.