Assign Projects to Governance Policies on the Fly

Overview

This guide is for teams running AI governance at scale — typically one Confident AI project per customer or per agent — that need every project enrolled into a governance policy automatically, without anyone clicking through the platform UI.

It builds directly on Provision Projects for Agents on the Fly: once your pipeline creates a project, the next step is to enroll that project into the governance policy that gates its deployment. A governance policy is organization-scoped (a named bundle of controls), and each project belongs to at most one policy.

In this guide, you will:

• Configure the Admin SDK with one Organization API Key.
• Find the target governance policy by name.
• Assign the project to the policy in code, as part of your pipeline.
• Verify enrollment by reading the project’s policy back.

Build It

$
pip install confidentai

$
export CONFIDENT_ORG_API_KEY="confident_us_org_..."

1
from confidentai import ConfidentAI
2
3
confident_ai = ConfidentAI()

1
from confidentai import ConfidentAI
2
3
confident_ai = ConfidentAI()
4
5
def find_policy_id(policy_name: str) -> str:
6
    organization = confident_ai.organization()
7
    policies = organization.governance.policies.list()
8
    for policy in policies:
9
        if policy.name == policy_name:
10
            return policy.id
11
    raise ValueError(f"No governance policy named {policy_name!r}")

1
from confidentai import ConfidentAI
2
3
confident_ai = ConfidentAI()
4
5
# find_policy_id() is defined above
6
7
def enroll_project(project_id: str, policy_name: str = "Production Gate") -> list[str]:
8
    policy_id = find_policy_id(policy_name)
9
    organization = confident_ai.organization()
10
    result = organization.governance.policies.assign(
11
        policy_id, project_ids=[project_id]
12
    )
13
    return result.assigned_project_ids

1
from confidentai import ConfidentAI
2
3
confident_ai = ConfidentAI()
4
5
project = confident_ai.project("project-uuid-1").get()
6
print(project.governance_policy)  # NamedRef(id="...", name="Production Gate")

Gate Deployments in CI

Everything above is the platform team’s job — enroll each project into the right policy once, as part of provisioning. From then on, the product team that owns a project gates its own deployments with the deepeval CLI. They don’t need the Organization API Key; they only need that project’s Project API Key (CONFIDENT_API_KEY).

$
export CONFIDENT_API_KEY="confident_us_proj_..."
$
deepeval gate

deepeval gate assesses every control in the project’s policy and exits with code 0 only when the whole policy passes — any failure exits non-zero and stops the deployment. See Gate deployments on a policy for the full reference.

Next Steps