Cerbi.Governance.Runtime 1.1.2

Cerbi.Governance.Runtime

🛡️ Real-time Governance Enforcement for Structured Logging

Cerbi.Governance.Runtime enables runtime validation of log messages against Cerbi governance profiles. It ensures your logs adhere to required and forbidden field policies, validates types, supports [CerbiTopic] inference, and enriches metadata for downstream audit and ML pipelines.

✅ Key Features

• Validates fields by severity: Required, Forbidden, Info
• Enforces type constraints (string, int, bool, etc.)
• Supports enumerated value enforcement (e.g., Status = Approved | Rejected)
• Detects [CerbiTopic] from method/class scope
• Honors GovernanceRelaxed = true override with proper tagging
• Tags every log with enforcement metadata:
  • GovernanceProfileUsed
  • GovernanceViolations
  • GovernanceEnforced
  • GovernanceMode
• Supports hot-reloading from JSON configuration

📦 Installation

dotnet add package Cerbi.Governance.Runtime

Also see:

• CerbiStream
• CerbiStream.GovernanceAnalyzer
• Cerbi.Serilog.GovernanceAnalyzer

🧩 Governance JSON Example

{
  "EnforcementMode": "Strict",
  "LoggingProfiles": {
    "Orders": {
      "RequireTopic": true,
      "AllowedTopics": ["Orders", "Users"],
      "FieldSeverities": {
        "userId": "Required",
        "email": "Required",
        "password": "Forbidden"
      },
      "FieldTypes": {
        "userId": "string",
        "email": "string"
      },
      "FieldEnums": {
        "Status": ["Pending", "Approved", "Rejected"]
      },
      "AllowRelax": true
    }
  }
}

🚀 Usage

With Manual Validation:

var validator = new RuntimeGovernanceValidator(
    isEnabled: () => true,
    profileName: "Orders",
    source: new FileGovernanceSource("cerbi_governance.json")
);

var log = new Dictionary<string, object>
{
    ["userId"] = "abc123",
    ["email"] = "invalid@example.com",
    ["Status"] = "Failed"
};

validator.ValidateInPlace(log); // Tags log with violations and metadata

With ILogger Extensions:

logger.LogInformation(validator, "Processing order", Guid.NewGuid().ToString());

🔄 Environment Metadata Support

The following environment variables are optionally read for ILogger extension tagging:

• CERBI_APP_ID → overrides ApplicationId
• CERBI_REGION → overrides Region
• CERBI_CLOUD → overrides CloudProvider

Fallbacks include:

• MachineName for InstanceId
• Default literals ("Unknown") if unset

🔌 Extending the Source

Use IRuntimeGovernanceSource to support custom loading strategies:

public interface IRuntimeGovernanceSource
{
    CerbiGovernance? Load();
    DateTime GetLastUpdatedUtc();
}

Provided:

• FileGovernanceSource (reloads when modified)

Future support planned:

• Azure Blob, GitHub raw JSON, GCS, S3

🔒 Relaxation Mode

Set GovernanceRelaxed = true in log data to bypass enforcement. Log will still be tagged as relaxed for audit:

{
  "GovernanceRelaxed": true,
  "GovernanceEnforced": false,
  "GovernanceProfileUsed": "Orders",
  "GovernanceMode": "Strict"
}

📄 License

MIT

This package is part of the Cerbi Suite – enabling governed, observable, and secure logging from the source.

Contact: hello@cerbi.io