Skip to main content

Governance, End to End

Skillsmith is a lifecycle-governance layer, not just a search index. A published skill goes through review before it's live, versions get deprecated instead of deleted, every action is auditable, compliance reports are exportable on demand, and anything flagged by security scanning is quarantined automatically.

Publish Review

A version published to the private registry doesn't go live automatically — it's a pending submission until a different team admin approves it. Self-approval is blocked, and once a submission is approved or rejected that decision is final for that version. See Private Registry for the full workflow.

Deprecation

An admin can deprecate an already-approved version of a private-registry skill instead of deleting it. Deprecating is a status flag, not a removal — the content still exists — but the version drops out of listing by default and is always excluded from direct lookup and install, unlike a rejected submission's permanent invisibility. It's how your team signals "no longer recommended" without breaking the audit trail for anyone who already installed it.

Deprecating and undeprecating are both handled by the same tool that manages the rest of the private registry — see Private Registry for the full tool reference.

Audit Trail & Compliance Reporting

Every governance-relevant action is logged and queryable. Query audit events for a specific time range or event type, export them for a SIEM (CloudWatch, Splunk, Datadog), or generate a compliance report — SOC 2, a CycloneDX AI-BOM, or plain JSON — for your own records.

This page covers the "what" and "why." For the full walkthrough — querying logs, exporting for compliance, running security audits at the skill and pack level — see Tutorial: Govern at scale.

Automatic Quarantine

Every indexed skill is security-scanned, and anything flagged is quarantined automatically — no manual step required to catch it. See Quarantine for the full mechanism: what triggers it, what happens to a quarantined skill, and how it gets reviewed.

Related Documentation