=== ControlPact Governance ===
Contributors: ctrlpact
Tags: ai, governance, automation, security, policy
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Govern AI and automation actions in WordPress using ControlPact.

== Description ==

ControlPact Governance connects WordPress to the ControlPact governance service.

The plugin allows a WordPress administrator to connect their site using
their own scoped ControlPact API credential.

ControlPact evaluates governed actions and returns one of three decisions:

* ALLOW
* APPROVE
* BLOCK

Each ControlPact customer uses their own organisation, agent assignment,
policy and scoped API credential.

No shared or developer-owned ControlPact API credential is bundled with
the plugin.

== External Service ==

This plugin connects to the external ControlPact governance service.

ControlPact service website:
https://ctrlpact.com

Privacy Policy:
https://ctrlpact.com/privacy

Terms of Service:
https://ctrlpact.com/terms

Current API service endpoint:
https://controlpact-backend.onrender.com

The external service is required for governance evaluations. The plugin
does not perform ControlPact policy evaluation locally.

When a governance evaluation is requested, the plugin may send:

* The requested action name.
* The governed resource.
* A unique reference ID.
* Context associated with the request.
* The WordPress site URL when used by the connection test or applicable integration.
* The configured ControlPact API credential in the HTTP Authorization header.

The API credential is used only to authenticate requests to ControlPact.

No governance request is sent until a WordPress administrator has
configured the plugin with a ControlPact API credential and uses or
enables functionality that requires a ControlPact decision.

== Privacy ==

The ControlPact API key is stored server-side in the WordPress options
database and is not printed back into the administration interface after
it has been saved.

The option is configured not to autoload with ordinary WordPress requests.

ControlPact Governance does not include advertising or unrelated tracking.

When governance functionality is used, information necessary to evaluate
the requested action is transmitted to the external ControlPact service
as described in the External Service section above.

Site administrators are responsible for ensuring that the contextual data
they send through governed actions is appropriate for their organisation
and applicable privacy requirements.

== Installation ==

1. Install and activate ControlPact Governance.
2. Open Settings > ControlPact.
3. Enter your own scoped ControlPact API key.
4. Click Save Connection.
5. Click Test ControlPact Connection.
6. An ALLOW, APPROVE or BLOCK response confirms that ControlPact evaluated the request.

== Frequently Asked Questions ==

= Does the plugin include a ControlPact API key? =

No. Every installation uses the customer's own scoped ControlPact API key.

= Does installing the plugin automatically provide Production access? =

No. Access is determined by the customer's ControlPact account,
organisation, entitlement and API credential.

= What does BLOCK mean? =

BLOCK is a valid ControlPact governance decision. It means the applicable
policy did not permit the requested action.

= Is ControlPact required? =

Yes. This plugin is an integration with the external ControlPact
governance service.

== Changelog ==

= 0.1.0 =
* Initial public release.
* Added server-side ControlPact connection.
* Added administrator-only API credential configuration.
* Added real governance connection testing.
* Added ALLOW, APPROVE and BLOCK decision support.