v1.2.2

Configuration

See where AIGP gets its settings, which environment variables it reads when starting, and which values you can change.

Configuration Sources

Boot configuration comes from environment variables; everything else is managed through the settings control plane at runtime. This split keeps secrets out of the runtime store while keeping operational tuning auditable.

Environment Variables

bash

AI_GOVERNANCE_API_HOST=127.0.0.1
AI_GOVERNANCE_API_PORT=8000
AI_GOVERNANCE_CORS_ALLOW_ORIGINS=http://localhost:3000
AI_GOVERNANCE_AUTH_MODE=keycloak
AI_GOVERNANCE_OIDC_ISSUER=https://keycloak.example/realms/ai-governance
AI_GOVERNANCE_GRAPH_URI=bolt://neo4j:7687

# Durable Replay Management
AI_GOVERNANCE_REPLAY_REPOSITORY=sqlite
AI_GOVERNANCE_REPLAY_SQLITE_PATH=/var/lib/ai-governance/governance.db
AI_GOVERNANCE_REPLAY_EXECUTION_CATALOG_BACKEND=sqlite
AI_GOVERNANCE_REPLAY_EXECUTION_CATALOG_SQLITE_PATH=/var/lib/ai-governance/governance.db
AI_GOVERNANCE_REPLAY_EVALUATION_PROVIDER=mock
AI_GOVERNANCE_RUN_REPLAY_WORKER=false
AI_GOVERNANCE_WORKER_POLL_SECONDS=1
AI_GOVERNANCE_WORKER_LEASE_SECONDS=300

OAuth Client Credentials

AI_GOVERNANCE_OAUTH_* is the generic confidential-client interface for AIGP workloads. The guided walkthrough and its release smoke test exchange these credentials for a short-lived token in memory; they do not require a manually exported bearer token.

bash

AI_GOVERNANCE_OAUTH_TOKEN_URL=https://keycloak.example/realms/ai-governance/protocol/openid-connect/token
AI_GOVERNANCE_OAUTH_CLIENT_ID=ai-governance-walkthrough
AI_GOVERNANCE_OAUTH_CLIENT_SECRET=loaded-from-a-secret-manager

Local ./servers.sh startup writes the configured development client to .env.oauth.generated. The file is ignored by Git and loaded automatically by ai-governance walkthrough. The generic scripts/oauth/fetch-access-token.py --clipboard helper is for a local tool that genuinely needs a token pasted into another client; the walkthrough itself does not need it.

Common Keys

evaluation.default_provider — default configured evaluation provider.
jobs.worker_concurrency — worker concurrency limit.
jobs.retry_attempts and jobs.retry_delay — retry budget and delay for retryable job work.
replay.drift.threshold_policy — thresholds applied when replay evidence is compared with a compatible source baseline.
ontology.reconciliation_interval — graph reconciliation cadence.
audit.retention — audit log retention window.

Telemetry Controls

Product telemetry is optional and separate from deployment-owned observability. UseAI_GOVERNANCE_TELEMETRY_MODE=disabled to prevent all outbound product telemetry. The exporter defaults to none; configuring PostHog requires a secret reference, not a plaintext key. See Telemetry & Privacy for the complete boundary.

Precedence

A setting resolves from the most specific applicable value: environment override, then project, organization, system, and finally the default. Environment-controlled values are deployment-owned and appear read-only in Studio; use scoped persisted settings for ordinary operational tuning.