Governance

Guardian Pro's Governance module helps you move from reactive governance to proactive enforcement. It covers tagging standards, service control policies, cost allocation, and organisational maturity -- giving you a single view of how well-governed your AWS environment is and what to do next.

Governance Phases

Guardian Pro organises governance maturity into three progressive phases:

Phase	Focus	Goal
Visibility	Discover your current governance posture	Understand what you have, where the gaps are, and what needs attention
Control	Enforce policies and fix violations	Apply tag policies, deploy guardrails, and remediate non-compliance
Optimise	Automate and refine	Enable auto-remediation, activate cost allocation tags, and achieve full coverage

Your current phase is determined by your governance score and the actions you have completed. The Governance page adapts its guidance and recommendations based on your phase.

What You Can Do

Tag Governance

Define tagging standards, monitor compliance across all resources, and fix violations individually or in bulk. Guardian Pro evaluates your resources against your tag policies and surfaces non-compliant resources with actionable remediation.

• Tag Governance -- Compliance monitoring, violations, and remediation.
• AI Tag Strategy -- AI-generated tagging recommendations tailored to your infrastructure.

Service Control Policies

Review your guardrail coverage across six security categories, deploy pre-built SCP templates, and detect drift when policies are modified outside Guardian Pro.

• SCP Management -- Guardrails, templates, deployment, and drift detection.

Maturity Assessment

Track your governance score across four dimensions, see how each area contributes to your overall posture, and follow a prioritised roadmap of actions to improve.

• Maturity Assessment -- Score breakdown, dimensions, and roadmap.

Organisation and Cost Allocation

Understand how governance applies across your AWS Organisation, activate cost allocation tags, and ensure all accounts are covered.

• Organisation Scope -- Multi-account governance, cost allocation tags, and OU structure.

Getting Started

Prerequisites

• At least one AWS account connected to Guardian Pro with a completed initial scan.
• governance:read permission to view governance data.
• governance:write permission to run assessments, fix violations, create policies, and deploy guardrails.

Running Your First Assessment

1. Navigate to Governance from the left sidebar.
2. Click Run Assessment.
3. Guardian Pro evaluates your tagging compliance, guardrail coverage, account structure, and cost allocation readiness.
4. Once complete, you will see your governance score, dimension breakdowns, and a prioritised roadmap.

tip

The governance assessment runs automatically on a daily schedule. You can also trigger it manually at any time from the Governance page.

The Governance Page

Status Bar

After your first assessment, a status bar appears at the top of the page showing:

• Governance score (0--100) with colour coding (green, yellow, or red) and your current phase.
• Score change since the previous assessment (trending up or down).
• Key metrics -- compliance percentage, open violation count, and policy count.
• Guardrail coverage -- how many of the six security categories are covered (shown when SCP management is available).
• Account coverage -- how many accounts are onboarded (shown for multi-account setups).

Action Cards

Context-aware cards highlight your most pressing governance issues and link directly to the relevant section. Examples include:

• Tag violations requiring attention.
• Missing tag strategy.
• Strategy recommendations not yet enforced as policies.
• Guardrail gaps.
• Cost allocation tags not yet activated.

When all monitored controls are healthy, a success banner confirms your governance posture is in good shape.

Staleness Warning

If the last assessment is more than 24 hours old, a warning banner shows the assessment age and offers a Reassess Now button.

Export

After your first assessment, you can export governance data from the header:

• CSV -- Exports violation data as a spreadsheet-ready file.
• JSON -- Exports the full assessment, compliance data, and violations as structured JSON.

Organisation Requirements

Some governance features require an AWS Organisation with a management account connected to Guardian Pro:

Feature	Single Account	AWS Organisation
Tag compliance and violations	Full	Full
AI tag strategy	Full	Full + OU-level recommendations
Tag policies	Full	Full + OU/root targeting
SCP management	Not available	Full
Cost allocation tags	Not available	Full
Maturity assessment	Partial (2 of 4 dimensions)	Full (all 4 dimensions)

info

For single-account setups, Guardian Pro focuses on tag governance and assessment. SCP management and cost allocation features become available when you connect your management account.

Next Steps

• Tag Governance -- Monitor and fix tagging compliance.
• AI Tag Strategy -- Generate a tailored tagging strategy.
• SCP Management -- Deploy guardrails and detect drift.
• Maturity Assessment -- Track your governance score and roadmap.
• Organisation Scope -- Manage multi-account governance and cost allocation.